VulnerabilityModified
CVE-2023-4969
A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on various architectures.
MEDIUM 6.5EPSS 1.19%
Does this matter?
Lower severity and a low EPSS score (1.19%). Track it; it rarely justifies an emergency change on its own.
Description
A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on various architectures.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- EPSS
- 1.19% probability · 66th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-401
- Affected
- khronos/opencl · khronos/vulkan · imaginationtech/ddk · amd/instinct mi300x firmware · amd/instinct mi300a firmware · amd/instinct mi250 firmware · amd/instinct mi210 firmware · amd/instinct mi100 firmware · amd/radeon instinct mi50 firmware · amd/radeon instinct mi25 firmware · amd/radeon pro v620 firmware · amd/radeon pro v520 firmware · amd/radeon pro w7600 firmware · amd/radeon pro w7500 firmware · amd/radeon pro w6400 firmware · amd/radeon pro w6500m firmware · amd/radeon pro w6300m firmware · amd/radeon pro w5700x firmware · amd/radeon pro w5500x firmware · amd/radeon rx 7900xtx firmware · +40 more
- Source
- cret@cert.org
References
- https://blog.trailofbits.comExploit, Mitigation, Third Party Advisory
- https://kb.cert.org/vuls/id/446598Third Party Advisory, US Government Resource
- https://registry.khronos.org/OpenCL/specs/3.0-unified/html/OpenCL_API.html#_fundamental_memory_regionsTechnical Description
- https://registry.khronos.org/vulkan/specs/1.3-extensions/html/index.htmlVendor Advisory
- https://www.kb.cert.org/vuls/id/446598Third Party Advisory, US Government Resource
- https://blog.trailofbits.comExploit, Mitigation, Third Party Advisory
- https://kb.cert.org/vuls/id/446598Third Party Advisory, US Government Resource
- https://registry.khronos.org/OpenCL/specs/3.0-unified/html/OpenCL_API.html#_fundamental_memory_regionsTechnical Description
- https://registry.khronos.org/vulkan/specs/1.3-extensions/html/index.htmlVendor Advisory
- https://www.kb.cert.org/vuls/id/446598Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.