Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-25179

Summary
Assigner-imaginationtech
Assigner Org ID-367425dc-4d06-4041-9650-c2dc6aaa27ce
Published At-02 Jun, 2025 | 04:19
Updated At-02 Jun, 2025 | 14:13
Rejected At-
Credits

GPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memory

Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:imaginationtech
Assigner Org ID:367425dc-4d06-4041-9650-c2dc6aaa27ce
Published At:02 Jun, 2025 | 04:19
Updated At:02 Jun, 2025 | 14:13
Rejected At:
▼CVE Numbering Authority (CNA)
GPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memory

Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages.

Affected Products
Vendor
Imagination Technologies LimitedImagination Technologies
Product
Graphics DDK
Platforms
  • Linux
  • Android
Default Status
unknown
Versions
Affected
  • 1.15 RTM (custom)
  • 1.17 RTM (custom)
  • 1.18 RTM (custom)
  • From 23.2 RTM through 24.3 RTM (custom)
Unaffected
  • 25.1 RTM (custom)
Problem Types
TypeCWE IDDescription
CWECWE-280CWE-280: Improper Handling of Insufficient Permissions or Privileges
Type: CWE
CWE ID: CWE-280
Description: CWE-280: Improper Handling of Insufficient Permissions or Privileges
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-679CAPEC-679: Exploitation of Improperly Configured or Implemented Memory Protections
CAPEC ID: CAPEC-679
Description: CAPEC-679: Exploitation of Improperly Configured or Implemented Memory Protections
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://www.imaginationtech.com/gpu-driver-vulnerabilities/
N/A
Hyperlink: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
3.17.8HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Version: 3.1
Base score: 7.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:367425dc-4d06-4041-9650-c2dc6aaa27ce
Published At:02 Jun, 2025 | 05:15
Updated At:11 Jul, 2025 | 16:29

Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.17.8HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 7.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CPE Matches

Imagination Technologies Limited
imaginationtech
>>ddk>>Versions up to 24.3(inclusive)
cpe:2.3:a:imaginationtech:ddk:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-280Secondary367425dc-4d06-4041-9650-c2dc6aaa27ce
CWE ID: CWE-280
Type: Secondary
Source: 367425dc-4d06-4041-9650-c2dc6aaa27ce
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://www.imaginationtech.com/gpu-driver-vulnerabilities/367425dc-4d06-4041-9650-c2dc6aaa27ce
Vendor Advisory
Hyperlink: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
Source: 367425dc-4d06-4041-9650-c2dc6aaa27ce
Resource:
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

53Records found

CVE-2024-32488
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.8||HIGH
EPSS-0.03% / 5.36%
||
7 Day CHG~0.00%
Published-15 Apr, 2024 | 00:00
Updated-09 Jul, 2025 | 14:52
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the update-service folder allow attackers to place crafted DLL files there.

Action-Not Available
Vendor-n/aFoxit Software IncorporatedMicrosoft Corporation
Product-pdf_readerpdf_editorwindowsn/apdf_readerpdf_editor
CWE ID-CWE-280
Improper Handling of Insufficient Permissions or Privileges
CVE-2024-23704
Matching Score-4
Assigner-Android (associated with Google Inc. or Open Handset Alliance)
ShareView Details
Matching Score-4
Assigner-Android (associated with Google Inc. or Open Handset Alliance)
CVSS Score-7||HIGH
EPSS-0.01% / 0.20%
||
7 Day CHG~0.00%
Published-07 May, 2024 | 21:01
Updated-17 Dec, 2024 | 16:42
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In onCreate of WifiDialogActivity.java, there is a possible way to bypass the DISALLOW_ADD_WIFI_CONFIG restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Action-Not Available
Vendor-Google LLC
Product-androidAndroidandroid
CWE ID-CWE-280
Improper Handling of Insufficient Permissions or Privileges
CWE ID-CWE-862
Missing Authorization
CVE-2024-51459
Matching Score-4
Assigner-IBM Corporation
ShareView Details
Matching Score-4
Assigner-IBM Corporation
CVSS Score-8.4||HIGH
EPSS-0.01% / 1.08%
||
7 Day CHG~0.00%
Published-19 Mar, 2025 | 18:08
Updated-07 Jul, 2025 | 16:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
IBM InfoSphere Server Information command execution

IBM InfoSphere Information Server 11.7 could allow a local user to execute privileged commands due to the improper handling of permissions.

Action-Not Available
Vendor-Linux Kernel Organization, IncMicrosoft CorporationIBM Corporation
Product-aixinfosphere_information_serverwindowslinux_kernelInfoSphere Information Server
CWE ID-CWE-280
Improper Handling of Insufficient Permissions or Privileges
  • Previous
  • 1
  • 2
  • Next
Details not found