CVE-2025-1246: Memory Buffer Overrun Vulnerability in Arm GPU Userspace Drivers

Overview

The CVE-2025-1246 vulnerability is a critical security flaw found in Arm Ltd’s Bifrost, Valhall, and Arm 5th Gen GPU Architecture Userspace Drivers. This flaw allows a non-privileged user process to perform valid GPU processing operations, such as through WebGL or WebGPU, and potentially access outside of buffer bounds. This could lead to a system compromise or data leakage, putting sensitive data at risk. Given the widespread use of Arm’s GPU drivers in various devices and systems, the impact of this vulnerability could be significant if left unpatched.

Vulnerability Summary

CVE ID: CVE-2025-1246
Severity: High (CVSS: 7.8)
Attack Vector: Local
Privileges Required: Low
User Interaction: None
Impact: System Compromise, Data Leakage

Affected Products

Product | Affected Versions

Bifrost GPU Userspace Driver | r18p0 through r49p3, r50p0 through r51p0
Valhall GPU Userspace Driver | r28p0 through r49p3, r50p0 through r54p0
Arm 5th Gen GPU Architecture Userspace Driver | r41p0 through r49p3, r50p0 through r54p0

How the Exploit Works

The exploit takes advantage of the improper restriction of operations within the bounds of a memory buffer in the affected GPU drivers. An attacker would typically craft a specific GPU processing operation, such as a WebGL or WebGPU command, that forces the GPU to write or read outside of its designated memory buffer. This could lead to a buffer overrun or underrun, allowing the attacker to execute code, alter existing data, or extract sensitive information from the system.

Conceptual Example Code

A hypothetical exploit might involve a malicious WebGL script that triggers the vulnerability. The script could look something like this:

let canvas = document.createElement('canvas');
let gl = canvas.getContext('webgl');
let buffer = gl.createBuffer();
gl.bindBuffer(gl.ARRAY_BUFFER, buffer);
gl.bufferData(gl.ARRAY_BUFFER, new Float32Array([1.0, 2.0, 3.0, 4.0]), gl.STATIC_DRAW);
// The following command attempts to read beyond the buffer's bounds
gl.getBufferSubData(gl.ARRAY_BUFFER, 5000, new Float32Array(1));

This code creates a buffer with 4 floating-point values, but then attempts to read data from a location far beyond the buffer’s bounds, potentially accessing sensitive data or triggering unwanted behavior in the GPU userspace driver.