CVE-2025-0072: Local Non-Privileged User Exploit in Arm Ltd GPU Kernel Drivers

Overview

The focus of our discussion in this blog post is CVE-2025-0072, a critical vulnerability that affects Arm Ltd GPU Kernel Drivers. It is a Use After Free vulnerability that allows a local non-privileged user process to perform improper GPU memory processing operations and gain unauthorized access to already freed memory. This vulnerability can potentially lead to system compromise or data leakage, posing a high risk to any system utilizing the affected drivers. In the era of cybersecurity threats, understanding this vulnerability, its possible impacts, and mitigation measures is of utmost importance for cybersecurity professionals and system administrators alike.

Vulnerability Summary

CVE ID: CVE-2025-0072
Severity: High (7.8 CVSS Score)
Attack Vector: Local
Privileges Required: Low (Non-privileged)
User Interaction: Required
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

Valhall GPU Kernel Driver | r29p0 through r49p3, r50p0 through r53p0
Arm 5th Gen GPU Architecture Kernel Driver | r41p0 through r49p3, r50p0 through r53p0

How the Exploit Works

In the context of a Use After Free vulnerability, an attacker exploits the improper processing of GPU memory operations by accessing memory that has already been freed. This allows the attacker to read from, write to, or execute code from memory locations that should not be accessible. As a result, the attacker can gain control over the system or leak sensitive data.

Conceptual Example Code

While the exact code to exploit this vulnerability is beyond the scope of this article, a conceptual example might look something like this:

void exploit() {
char* ptr = malloc(100);   // Allocate 100 bytes
free(ptr);                 // Free the allocated memory
strcpy(ptr, "malicious_payload");  // Write to the freed memory
execute(ptr);              // Execute the malicious payload
}

In this conceptual example, memory is allocated and then freed. Following that, the same memory space is used to store a malicious payload, which is then executed. This demonstrates the essence of a Use After Free vulnerability, where the freed memory is not properly managed and can be accessed post-deallocation.