Use-after-free in Valhall GPU Kernel Driver and Bifrost GPU Kernel Driver - CVE-2024-4610
Published: June 11, 2024
Vulnerability identifier: #VU91689
CSH Severity: High
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-4610
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error caused by improper GPU memory processing operations. A local user can execute arbitrary code with elevated privileges.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Valhall GPU Kernel Driver
Bifrost GPU Kernel Driver
Google Android
Bifrost GPU Kernel Driver
Google Android
How to mitigate CVE-2024-4610
Install updates from vendor's website.
Valhall GPU Kernel Driver - update to r41p0
Bifrost GPU Kernel Driver - update to r41p0
Google Android - addressed in versions 12L 2024-07-05, 12 2024-07-05, 13 2024-07-05, 14 2024-07-05
Bifrost GPU Kernel Driver - update to r41p0
Google Android - addressed in versions 12L 2024-07-05, 12 2024-07-05, 13 2024-07-05, 14 2024-07-05