CVE-2024-2937

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p0; Valhall GPU Kernel Driver: from r41p0 through r49p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p0.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Arm Ltd	Bifrost GPU Kernel Driver	>= r41p0, <= r49p0
Arm Ltd	Valhall GPU Kernel Driver	>= r41p0, <= r49p0
Arm Ltd	Arm 5th Gen GPU Architecture Kernel Driver	>= r41p0, <= r49p0
arm	bifrost_gpu_kernel_driver	>= r41p0, <= r49p0
arm	valhall_gpu_kernel_driver	>= r41p0, <= r49p0
arm	5th_gen_gpu_architecture_kernel_driver	>= r41p0, <= r49p0

References

https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20VulnerabilitiesVendor Advisory

Timeline

Published: Aug 5, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-293705.3In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting CVE-2024-293717.5In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token wi CVE-2024-293746.1A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.CVE-2024-293759.8CSV Injection vulnerability in Addactis IBNRS v.3.10.3.107 allows a remote attacker to execute arbitrary code via a crafted .ibnrs file to t CVE-2024-293766.4Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.CVE-2024-29386.5A vulnerability was found in Campcodes Online Examination System 1.0. It has been rated as critical. This issue affects some unknown process CVE-2024-293847.5An issue in CSS Exfil Protection v.1.1.0 allows a remote attacker to obtain sensitive information via the content.js and parseCSSRules funct CVE-2024-293859.0DIR-845L router <= v1.01KRb03 has an Unauthenticated remote code execution vulnerability in the cgibin binary via soapcgi_main function.CVE-2024-293865.4projeqtor up to 11.2.0 was discovered to contain a SQL injection vulnerability via the component /view/criticalResourceExport.php.CVE-2024-293878.8projeqtor up to 11.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /view/print.php.CVE-2024-29396.1A vulnerability classified as problematic has been found in Campcodes Online Examination System 1.0. Affected is an unknown function of the CVE-2024-293907.3Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the 'add-