CVE-2024-0153: Arm 5th Gen GPU Buffer Overflow Flaw

CVE-2024-0153 Overview

CVE-2024-0153 is a memory buffer bounds vulnerability affecting Arm Ltd Valhall GPU Firmware and Arm 5th Gen GPU Architecture Firmware. This improper restriction of operations within the bounds of a memory buffer allows a local non-privileged user to perform improper GPU processing operations that access memory outside of buffer bounds. If the operations are carefully prepared, this vulnerability could enable an attacker to gain access to all system memory, representing a significant security risk for affected devices.

Critical Impact

A local attacker with low privileges can exploit improper GPU processing operations to access memory outside of buffer bounds, potentially escalating to full system memory access.

Affected Products

• Arm Valhall GPU Firmware (versions r29p0 through r46p0)
• Arm 5th Gen GPU Architecture Firmware (versions r41p0 through r46p0)

Discovery Timeline

• 2024-07-01 - CVE-2024-0153 published to NVD
• 2025-03-27 - Last updated in NVD database

Technical Details for CVE-2024-0153

Vulnerability Analysis

This vulnerability stems from CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a class of memory safety issues that occurs when software performs operations on a memory buffer without properly validating that the operations stay within the buffer's intended boundaries.

The attack requires local access and low privileges to exploit, but requires no user interaction. When successfully exploited, the vulnerability impacts confidentiality, integrity, and availability of the system. The potential for complete system memory access makes this a particularly dangerous flaw, as attackers could read sensitive data, modify critical system memory, or cause system instability.

Root Cause

The root cause lies in insufficient bounds checking within the GPU firmware when processing certain GPU operations. The firmware fails to properly validate that memory access operations remain within the allocated buffer boundaries. This allows specially crafted GPU processing requests to read or write memory locations outside the intended buffer space.

Attack Vector

The attack vector is local, requiring an attacker to have low-privilege access to the system. The exploitation process involves carefully preparing GPU processing operations that exploit the bounds checking weakness. While initially limited to accessing a small amount of memory outside buffer bounds, a sophisticated attacker can chain these operations to potentially access all system memory.

The vulnerability does not require any user interaction to exploit, making it suitable for automated exploitation once an attacker has local access. The attack complexity is low, meaning no specialized conditions need to be met beyond having local access to submit GPU processing requests.

Detection Methods for CVE-2024-0153

Indicators of Compromise

• Unusual GPU memory access patterns or errors in system logs
• Unexpected GPU driver crashes or system instability
• Anomalous memory access attempts detected by memory protection mechanisms
• Suspicious processes making excessive GPU processing requests

Detection Strategies

• Monitor GPU driver and firmware logs for memory access violations or boundary errors
• Implement memory integrity monitoring to detect out-of-bounds access attempts
• Deploy endpoint detection solutions capable of monitoring GPU subsystem behavior
• Review system logs for unusual GPU processing patterns from non-privileged users

Monitoring Recommendations

• Enable detailed logging for GPU driver operations where supported
• Configure alerting for memory boundary violation events
• Monitor for privilege escalation attempts following GPU-related anomalies
• Implement regular firmware version auditing to ensure patched versions are deployed

How to Mitigate CVE-2024-0153

Immediate Actions Required

• Identify all devices using affected Arm Valhall or 5th Gen GPU firmware versions
• Prioritize updating firmware to versions newer than r46p0
• Apply vendor-provided security patches as soon as they become available
• Restrict local access to systems with affected GPU firmware where possible

Patch Information

Arm has published security information regarding this vulnerability. Organizations should consult the Arm Security Center Mali GPU Driver Vulnerabilities page for the latest patch information and remediation guidance. Affected versions include Valhall GPU Firmware from r29p0 through r46p0 and Arm 5th Gen GPU Architecture Firmware from r41p0 through r46p0.

Workarounds

• Limit local system access to trusted users only until patching is complete
• Implement additional access controls on GPU processing capabilities where possible
• Monitor affected systems closely for signs of exploitation
• Consider network segmentation for devices that cannot be immediately patched

For systems where firmware updates cannot be immediately applied, organizations should implement defense-in-depth strategies including enhanced monitoring and access restrictions. Consult the Arm Security Center for the most current mitigation guidance specific to your deployment.