CVE-2024-36332 describes a GPU hardware register isolation flaw that could let a privileged attacker inside a malicious guest VM access GPU MMIO register ranges that should be isolated from the guest. The issue is specifically about improper isolation of GPU HW register space, affecting virtualization environments that expose GPU hardware (or GPU MMIO) to guest VMs. The NVD text does not specify the affected vendor/product names or exact versions, so those details cannot be confirmed from the provided input.
Technically, the root cause is “improper isolation of GPU HW register space,” meaning the guest’s access controls for GPU MMIO/register mappings are insufficient. The attack vector, as described, is a privileged attacker operating from within a malicious guest VM. The exploitation mechanism is therefore an in-guest attempt to reach unauthorized GPU MMIO register ranges that are intended to be accessible only to the host or to properly isolated contexts. The consequence described is that this unauthorized access can trigger a host OS reboot, resulting in a denial-of-service (DoS) condition. No specific code paths, functions, hypervisor components, or register names are included in the provided material, and no reference content (patch notes, advisories, or PoC write-ups) was available to extract further technical specifics.
Impact: An attacker with privileged access in a malicious guest VM may be able to cause the host OS to reboot by accessing unauthorized GPU MMIO register ranges. This is primarily a denial-of-service risk (host instability/reboot), with the blast radius limited to the affected host and its hosted workloads/VMs. The provided severity is “unknown,” and the CVSS score/vector are not available (“N/A”), so the exact risk level cannot be quantified beyond the described DoS outcome.
Mitigation: The provided input does not include patched versions, vendor workarounds, or configuration guidance. Based strictly on the NVD description, the practical mitigation would be to apply vendor/hypervisor updates that fix GPU HW register space isolation, and to ensure that guest privilege is tightly controlled (since exploitation requires a privileged attacker in the guest). If you have access to the relevant vendor advisory for this CVE, use it to identify the exact fixed versions and any recommended configuration changes for GPU passthrough/virtualized GPU MMIO exposure. Additionally, monitor for signs of host GPU/MMIO faults or unexpected host reboots correlated with activity from privileged guest contexts, though no detection indicators are provided in the supplied content.
CWE-1189