CVE-2024-43702: GPU System Call Privilege Escalation Flaw

CVE-2024-43702 Overview

CVE-2024-43702 affects Imagination Technologies GPU drivers. Software running as a non-privileged user can issue improper GPU system calls that grant unprivileged access to arbitrary physical memory pages. The flaw is categorized under [CWE-280] (Improper Handling of Insufficient Permissions or Privileges).

An attacker with low-privileged local code execution can read or modify kernel memory, other processes' memory, or firmware regions through the GPU driver interface. This breaks the process isolation boundary enforced by the operating system kernel.

Critical Impact
Non-privileged software can read and write arbitrary physical memory through the GPU driver, enabling privilege escalation, credential theft, and kernel compromise.

Affected Products

Imagination Technologies PowerVR GPU DDK (Driver Development Kit)
Devices shipping Imagination GPU drivers on Android, Linux, and embedded platforms
Downstream SoC vendors integrating the affected PowerVR kernel driver

Discovery Timeline

2024-11-30 - CVE-2024-43702 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43702

Vulnerability Analysis

The vulnerability resides in the PowerVR GPU kernel driver's handling of user-issued system calls. The driver exposes ioctl-style interfaces that accept memory-mapping and buffer-management requests from userspace clients. When a non-privileged process submits crafted parameters, the driver fails to validate that the caller has sufficient privileges to reference the requested physical memory pages.

As a result, the driver maps arbitrary physical pages into the calling process's address space or performs DMA operations against them. The GPU's memory management unit is instructed to service requests that bypass normal kernel access checks. This yields read and write access to physical memory outside the process's legitimate mapping.

The consequences include disclosure of kernel data structures, tampering with credentials or page tables, and eventual privilege escalation to root or kernel context. Because GPU drivers frequently execute at high privilege and interact with DMA-capable hardware, the impact extends beyond the calling process.

Root Cause

The root cause is improper permission handling in the GPU driver's memory-related system calls [CWE-280]. Privilege and capability checks are either missing or performed on attacker-controlled input, allowing a low-privileged caller to reference physical memory it should not access.

Attack Vector

Exploitation requires the attacker to run code as a non-privileged user on a device using the affected Imagination GPU driver. The attacker invokes the driver's system call interface with crafted arguments that reference target physical pages. No user interaction is required beyond execution of the malicious binary or app.

The vulnerability manifests through the GPU driver's ioctl surface. See the Imagination Technologies GPU Driver Vulnerabilities advisory for driver-specific technical details.

Detection Methods for CVE-2024-43702

Indicators of Compromise

Unexpected user processes opening GPU driver device nodes such as /dev/pvr_sync, /dev/dri/*, or vendor-specific PowerVR nodes
Anomalous ioctl call patterns from non-graphics applications against GPU driver interfaces
Kernel logs showing unusual PowerVR memory-mapping or buffer allocation events tied to low-privileged UIDs

Detection Strategies

Audit which processes open GPU driver device files and correlate against expected graphics workloads
Monitor kernel dmesg output and audit subsystem logs for PowerVR driver warnings or unusual mapping requests
Baseline legitimate GPU driver ioctl usage and alert on deviations from unprivileged processes

Monitoring Recommendations

Enable Linux audit rules on GPU device node access and forward events to a centralized SIEM
Track post-exploitation behavior such as sudden privilege changes, credential dumping, or unexpected kernel module loads
Correlate GPU driver activity with process lineage to identify non-graphics binaries touching the driver

How to Mitigate CVE-2024-43702

Immediate Actions Required

Inventory devices and systems shipping Imagination PowerVR GPU drivers and identify the running DDK version
Apply vendor-supplied driver updates from device manufacturers as soon as they are released
Restrict which local user accounts can execute untrusted code on affected devices

Patch Information

Imagination Technologies has published driver fixes through its coordinated disclosure process. Refer to the Imagination Technologies GPU Driver Vulnerabilities advisory for the fixed DDK version and downstream vendor guidance. Device OEMs must integrate the fixed driver into their firmware or OS updates before end-users receive protection.

Workarounds

Limit installation of untrusted applications on affected devices until vendor patches are applied
Where feasible, restrict permissions on GPU device nodes to trusted graphics services only
Apply application allowlisting to prevent execution of unknown binaries on affected endpoints

bash

# Example: restrict access to PowerVR device nodes on Linux
ls -l /dev/pvr_sync /dev/dri/renderD*
chmod 0660 /dev/pvr_sync
chgrp video /dev/pvr_sync
# Audit access to GPU device nodes
auditctl -w /dev/pvr_sync -p rwa -k gpu_access
auditctl -w /dev/dri -p rwa -k gpu_access