CyberRota Analysis
AI-GeneratedA vulnerability exists in software running as a non-privileged user that improperly handles GPU system calls, specifically during workload submissions involving exported fences from the GPU driver. This flaw can lead to use-after-free conditions due to incorrect reference counting of synchronization primitives, potentially allowing attackers to manipulate memory and execute arbitrary code. Organizations utilizing GPU-accelerated applications should prioritize addressing this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. This can be exploited, by destroying the exported fence and prematurely release the underlying primitive, resulting in a potential use-after-free condition.
Related CVEs
Other vulnerabilities affecting the same vendor(s)