Imagination PowerVR GPU driver - pinned memory lifecycle: MULTI-TENANT ISOLATION: an unprivileged app allocates pinned

Impact

MULTI-TENANT ISOLATION: an unprivileged app allocates pinned GPU memory, unpins it so the page can be freed and reallocated elsewhere, and keeps using it in GPU calls - a use-after-free that reads and writes pages now belonging to something else. Scored 9.8. This is the GPU-memory-lifecycle bug class that matters most for shared accelerators: the GPU keeps a mapping the OS thinks it revoked.

Who can reach it

Unprivileged local application with GPU access. Re-filed as CVE-2022-20122 in a later Android bulletin.

What to do

Update the vendor GPU driver. The transferable lesson for a GPU fleet is to ask, for whichever accelerator you run, whether unpinning actually tears down the device-side mapping - the same design mistake is what makes GPU memory reuse dangerous on any vendor.

References