CVE-2024-6790

Feb. 3, 2025, 4:15 p.m.

4.0
Low

Description

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a non-privileged user process to make valid GPU memory processing operations, including via WebGL or WebGPU, to cause the whole system to become unresponsive.This issue affects Bifrost GPU Kernel Driver: r44p1, from r46p0 through r49p0, from r50p0 through r51p0; Valhall GPU Kernel Driver: r44p1, from r46p0 through r49p0, from r50p0 through r51p0; Arm 5th Gen GPU Architecture Kernel Driver: r44p1, from r46p0 through r49p0, from r50p0 through r51p0.

Product(s) Impacted

Product Versions
Arm Bifrost GPU Kernel Driver
  • ['r44p1', 'r46p0 - r49p0', 'r50p0 - r51p0']
Arm Valhall GPU Kernel Driver
  • ['r44p1', 'r46p0 - r49p0', 'r50p0 - r51p0']
Arm 5th Gen GPU Architecture Kernel Driver
  • ['r44p1', 'r46p0 - r49p0', 'r50p0 - r51p0']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References

https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities

Tags

CWE-835
arm-security@arm.com
2025-02-03
CVE-2024-6790

CVSS Score

4.0 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: LOW
  • Availability Impact: NONE

    • CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

    View Vector String

Timeline

Published: Feb. 3, 2025, 11:15 a.m.
Last Modified: Feb. 3, 2025, 4:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

arm-security@arm.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.