CVE-2023-44216 Information disclosure in n/a
Attackers can steal cross-origin pixel data from web pages using GPU compression side channels, exposing sensitive text content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-44216?
CVE-2023-44216 is a medium-severity vulnerability in Apple Macos, published on 26 Sep 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing attacks against feTurbulence and feBlend in the SVG Filter specification, aka a GPU.zip issue. For example, attackers can sometimes accurately determine text contained on a web page from one origin if they control a resource from a different origin.
Weakness: CWE-203
Which versions are affected by CVE-2023-44216?
It affects 16 products.
Products include Amd Ryzen 5 7600x, Amd Ryzen 7 4800u, Apple M1 Mac Mini, Apple Macos, Canonical Ubuntu Linux, Google Android and 10 more.
How do I fix CVE-2023-44216?
No fix has been published for CVE-2023-44216 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-44216 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-44216 exists.
Sources
Also known as GHSA-fjqr-32v8-6gf9, UBUNTU-CVE-2023-44216.