GPU VulnDB

Database/Control plane, storage & DevOps

Imagination PowerVR GPU driver - memory residue: MULTI-TENANT ISOLATION: an unprivileged application gets the GPU

CVE-2021-0891Control plane, storage & DevOpsPowerVR uninitialized heap disclosurecurated

Impact

MULTI-TENANT ISOLATION: an unprivileged application gets the GPU driver to hand back uninitialized heap memory, disclosing whatever the previous consumer left there. Same residual-memory class as LeftoverLocals and included here as evidence the class is a driver-design pattern rather than a one-off - if you evaluate a non-NVIDIA accelerator, ask the vendor specifically what their driver zeroes on allocation.

Who can reach it

An unprivileged local application with access to the GPU device node.

What to do

Update to the fixed Imagination DDK / vendor driver. In the datacenter this matters as a due-diligence question rather than a fleet action: PowerVR is not a datacenter part. Cost: driver update and reload where it applies.

References

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.