A high-severity out-of-range pointer vulnerability in the Imagination Graphics DDK could allow a guest VM to perform unauthorized memory writes outside its permitted address space.

This is an out-of-range pointer offset vulnerability (CWE-823) where improper commands sent from a Guest VM to the GPU firmware result in memory corruption. The flaw allows an attacker within a virtualized guest to bypass memory isolation constraints.

With a CVSS score of 7.8, this vulnerability poses a significant risk to the integrity and confidentiality of virtualized systems. An attacker may be able to manipulate data in memory outside of the guest, leading to potential privilege escalation or the theft of sensitive data from the host or other guests.

Immediate Action: Update the Graphics DDK to version 26.1 RTM2 or later to address the memory safety issue.

Proactive Monitoring: Review audit logs for suspicious GPU command activity and monitor for memory access errors or unexpected system behavior on hosts supporting guest GPU pass-through.

Compensating Controls: If patching is not immediately feasible, restrict the use of GPU pass-through features for untrusted or public-facing virtual machines.

Public Exploit Available: No

The risk of memory corruption in a virtualized environment necessitates prompt remediation. Administrators should verify their current DDK versions and apply the recommended updates to prevent potential unauthorized access to protected memory regions.