CVE-2024-43704: GPU System Privilege Escalation Flaw

CVE-2024-43704 Overview

CVE-2024-43704 is a local privilege boundary vulnerability affecting Imagination Technologies GPU drivers. Software installed and run as a non-privileged user can conduct improper GPU system calls to gain access to the graphics buffers of a parent process. The flaw is categorized under [CWE-668] Exposure of Resource to Wrong Sphere, allowing cross-process data exposure through the GPU driver interface. Because graphics buffers can contain rendered UI, credentials fields, or other sensitive framebuffer contents, unauthorized access has high confidentiality, integrity, and availability impact on affected devices.

Critical Impact
A local, unprivileged application can read and manipulate GPU-managed graphics buffers belonging to a parent process, breaking the process isolation boundary enforced by the operating system.

Affected Products

Imagination Technologies GPU driver stack (see vendor advisory for affected DDK versions)
Devices integrating PowerVR / Imagination GPU IP with the vulnerable driver
Downstream System-on-Chip vendors and OEMs shipping the impacted driver

Discovery Timeline

2024-11-18 - CVE-2024-43704 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43704

Vulnerability Analysis

The vulnerability resides in the Imagination Technologies GPU driver's handling of system calls originating from user-space applications. A non-privileged process can issue crafted GPU ioctl requests that reference graphics buffers owned by a parent process. Because the driver does not adequately verify the caller's right to those buffer handles, the kernel-side GPU subsystem exposes the memory contents across the process boundary.

Graphics buffers frequently contain sensitive rendered content, including window contents, decrypted media frames, and application UI state. Cross-process access to these buffers therefore breaks the confidentiality guarantees the operating system provides between processes running under different security contexts.

Root Cause

The root cause is improper resource isolation [CWE-668] within the GPU driver. The driver treats GPU buffer handles as accessible to related processes without enforcing the ownership and permission checks the kernel normally applies to shared memory objects. This design gap allows a child or sibling process to reach into the parent process's GPU allocations.

Attack Vector

Exploitation requires local code execution as a non-privileged user on the target device. An attacker delivers a malicious application, for example through a sideloaded package or a compromised app, which then executes as a child of a target process or shares GPU driver context with it. The application issues GPU system calls that resolve to buffers owned by the parent, reads their contents, and exfiltrates rendered data. No user interaction beyond running the malicious application is required, and no elevated privileges are needed on the exploiting side.

No verified public proof-of-concept code is available. See the Imagination Technologies Driver Vulnerabilities advisory for vendor-provided technical details.

Detection Methods for CVE-2024-43704

Indicators of Compromise

Unexpected non-privileged processes issuing high volumes of GPU driver ioctl calls, particularly buffer import or map operations
Child processes accessing GPU handles that were allocated by a parent process with a different UID or security context
Recently installed third-party applications that request GPU access without a legitimate rendering use case

Detection Strategies

Monitor kernel audit logs for anomalous GPU driver system calls originating from applications that do not normally render graphics
Baseline per-application GPU usage and alert on deviations, such as background processes performing framebuffer reads
Inspect installed application inventories on managed devices for packages known to abuse GPU driver interfaces

Monitoring Recommendations

Enable verbose driver logging on Imagination GPU stacks where the platform supports it, and forward logs to central analytics
Track process lineage for applications interacting with /dev/dri or vendor-specific GPU device nodes
Alert on newly installed unsigned or sideloaded applications on managed endpoints and mobile devices

How to Mitigate CVE-2024-43704

Immediate Actions Required

Apply the driver update from Imagination Technologies or the downstream SoC or OEM vendor for the affected device as soon as it is available
Inventory devices using Imagination Technologies GPU IP and confirm driver version against the vendor advisory
Restrict installation of untrusted third-party applications on affected devices until patches are deployed

Patch Information

Imagination Technologies has published fixed driver versions on its GPU Driver Vulnerabilities advisory page. Because the driver is distributed through SoC vendors and device OEMs, patch availability depends on the downstream integrator. Confirm that the shipped device firmware or driver update includes the fix referenced for CVE-2024-43704 before considering a device remediated.

Workarounds

Limit device usage to trusted, vetted applications from official stores until the driver update is applied
Enforce application allow-listing on managed devices to prevent execution of unknown binaries that could invoke GPU system calls
Where feasible, disable or restrict access to GPU device nodes for user accounts that do not require hardware-accelerated rendering

bash

# Example: restrict access to GPU device nodes to a dedicated render group on Linux
sudo groupadd -r render
sudo chown root:render /dev/dri/renderD*
sudo chmod 660 /dev/dri/renderD*
# Only add trusted user accounts to the render group
sudo usermod -a -G render <trusted_user>