Database/Control plane, storage & DevOps

Imagination PowerVR GPU driver - pinned memory lifecycle: An unprivileged app allocates pinned GPU memory, unpins it so

CVSS 9.8CVE-2021-39815Control plane, storage & DevOpsPowerVR pinned-memory UAFcurated

Impact

An unprivileged app allocates pinned GPU memory, unpins it so the page can be freed and reallocated elsewhere, and keeps using it in GPU calls - a use-after-free that reads and writes pages now belonging to something else. Scored 9.8. This is the GPU-memory-lifecycle bug class that matters most for shared accelerators: the GPU keeps a mapping the OS thinks it revoked.

Who can reach it

Unprivileged local application with GPU access. Re-filed as CVE-2022-20122 in a later Android bulletin.

What to do

Update the vendor GPU driver. The transferable lesson for a GPU fleet is to ask, for whichever accelerator you run, whether unpinning actually tears down the device-side mapping - the same design mistake is what makes GPU memory reuse dangerous on any vendor.

References

https://source.android.com/security/bulletin/2022-04-01 https://nvd.nist.gov/vuln/detail/CVE-2021-39815

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.