CVE-2023-4969 GPU kernel implementations susceptible to memory leak
Attackers can read sensitive data from other GPU kernels via local memory, affecting OS-level GPU drivers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-4969?
CVE-2023-4969 is a medium-severity vulnerability in Khronos Group OpenCL, published on 16 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on various architectures.
Weakness: CWE-401
Which versions are affected by CVE-2023-4969?
It affects 132 products.
Products include Amd Athlon 3000g Firmware, Amd Instinct Mi100 Firmware, Amd Instinct Mi210 Firmware, Amd Instinct Mi250 Firmware, Amd Instinct Mi300a Firmware, Amd Instinct Mi300x Firmware and 126 more.
How do I fix CVE-2023-4969?
Apply the vendor's patch.
Is CVE-2023-4969 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4969 exists.
Sources
Also known as DEBIAN-CVE-2023-4969, GHSA-95ph-5wpx-w6gq, UBUNTU-CVE-2023-4969.