CVE-2025-46708 - Vulnerability Details - OpenCVE

Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU.

No CVSS v4.0

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00023.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.imaginationtech.com/gpu-driver-vulnerabilities/

History

Tue, 01 Jul 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 27 Jun 2025 17:15:00 +0000

Type	Values Removed	Values Added
Description		Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU.
Title		GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs
Weaknesses		CWE-280
References		https://www.imaginationtech.com/gpu-driver-vulnerabilities/

MITRE

Status: PUBLISHED

Assigner: imaginationtech

Published: 2025-06-27T17:04:00.516Z

Updated: 2025-07-01T17:36:03.642Z

Reserved: 2025-04-28T18:57:24.837Z

Link: CVE-2025-46708

Vulnrichment

Updated: 2025-07-01T16:14:27.408Z

NVD

Status : Awaiting Analysis

Published: 2025-06-27T17:15:33.803

Modified: 2025-07-01T18:15:25.280

Link: CVE-2025-46708

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-46708", "assignerOrgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "state": "PUBLISHED", "assignerShortName": "imaginationtech", "dateReserved": "2025-04-28T18:57:24.837Z", "datePublished": "2025-06-27T17:04:00.516Z", "dateUpdated": "2025-07-01T17:36:03.642Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "platforms": ["Linux", "Android"], "product": "Graphics DDK", "vendor": "Imagination Technologies", "versions": [{"status": "affected", "version": "1.15 RTM", "versionType": "custom"}, {"status": "affected", "version": "1.17 RTM", "versionType": "custom"}, {"status": "affected", "version": "1.18 RTM", "versionType": "custom"}, {"lessThanOrEqual": "24.1 RTM", "status": "affected", "version": "23.2 RTM", "versionType": "custom"}, {"status": "unaffected", "version": "24.2 RTM1", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU.<br>"}], "value": "Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU."}], "impacts": [{"capecId": "CAPEC-480", "descriptions": [{"lang": "en", "value": "CAPEC - CAPEC-480: Escaping Virtualization (Version 3.9)"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-280", "description": "CWE - CWE-280: Improper Handling of Insufficient Permissions or Privileges (4.15)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "shortName": "imaginationtech", "dateUpdated": "2025-06-27T17:04:00.516Z"}, "references": [{"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/"}], "source": {"discovery": "UNKNOWN"}, "title": "GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-07-01T16:14:55.016435Z", "id": "CVE-2025-46708", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-01T17:36:03.642Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-46708", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-01T16:14:55.016435Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-01T16:14:27.408Z"}}], "cna": {"title": "GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-480", "descriptions": [{"lang": "en", "value": "CAPEC - CAPEC-480: Escaping Virtualization (Version 3.9)"}]}], "affected": [{"vendor": "Imagination Technologies", "product": "Graphics DDK", "versions": [{"status": "affected", "version": "1.15 RTM", "versionType": "custom"}, {"status": "affected", "version": "1.17 RTM", "versionType": "custom"}, {"status": "affected", "version": "1.18 RTM", "versionType": "custom"}, {"status": "affected", "version": "23.2 RTM", "versionType": "custom", "lessThanOrEqual": "24.1 RTM"}, {"status": "unaffected", "version": "24.2 RTM1", "versionType": "custom"}], "platforms": ["Linux", "Android"], "defaultStatus": "unknown"}], "references": [{"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU.", "supportingMedia": [{"type": "text/html", "value": "Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-280", "description": "CWE - CWE-280: Improper Handling of Insufficient Permissions or Privileges (4.15)"}]}], "providerMetadata": {"orgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "shortName": "imaginationtech", "dateUpdated": "2025-06-27T17:04:00.516Z"}}}, "cveMetadata": {"cveId": "CVE-2025-46708", "state": "PUBLISHED", "dateUpdated": "2025-07-01T17:36:03.642Z", "dateReserved": "2025-04-28T18:57:24.837Z", "assignerOrgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "datePublished": "2025-06-27T17:04:00.516Z", "assignerShortName": "imaginationtech"}, "dataVersion": "5.1"}