Vulnerability Description
A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on various architectures.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Khronos | Opencl | <= 3.0.11 |
| Khronos | Vulkan | <= 1.3.224 |
| Imaginationtech | Ddk | <= 23.2 |
| Amd | Instinct Mi300X Firmware | - |
| Amd | Instinct Mi300X | - |
| Amd | Instinct Mi300A Firmware | - |
| Amd | Instinct Mi300A | - |
| Amd | Instinct Mi250 Firmware | - |
| Amd | Instinct Mi250 | - |
| Amd | Instinct Mi210 Firmware | - |
| Amd | Instinct Mi210 | - |
| Amd | Instinct Mi100 Firmware | - |
| Amd | Instinct Mi100 | - |
| Amd | Radeon Instinct Mi50 Firmware | - |
| Amd | Radeon Instinct Mi50 | - |
| Amd | Radeon Instinct Mi25 Firmware | - |
| Amd | Radeon Instinct Mi25 | - |
| Amd | Radeon Pro V620 Firmware | - |
| Amd | Radeon Pro V620 | - |
| Amd | Radeon Pro V520 Firmware | - |
Related Weaknesses (CWE)
References
- https://blog.trailofbits.comExploitMitigationThird Party Advisory
- https://kb.cert.org/vuls/id/446598Third Party AdvisoryUS Government Resource
- https://registry.khronos.org/OpenCL/specs/3.0-unified/html/OpenCL_API.html#_fundTechnical Description
- https://registry.khronos.org/vulkan/specs/1.3-extensions/html/index.htmlVendor Advisory
- https://www.kb.cert.org/vuls/id/446598Third Party AdvisoryUS Government Resource
- https://blog.trailofbits.comExploitMitigationThird Party Advisory
- https://kb.cert.org/vuls/id/446598Third Party AdvisoryUS Government Resource
- https://registry.khronos.org/OpenCL/specs/3.0-unified/html/OpenCL_API.html#_fundTechnical Description
- https://registry.khronos.org/vulkan/specs/1.3-extensions/html/index.htmlVendor Advisory
- https://www.kb.cert.org/vuls/id/446598Third Party AdvisoryUS Government Resource
FAQ
What is CVE-2023-4969?
CVE-2023-4969 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on various architectures.
How severe is CVE-2023-4969?
CVE-2023-4969 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-4969?
Check the references section above for vendor advisories and patch information. Affected products include: Khronos Opencl, Khronos Vulkan, Imaginationtech Ddk, Amd Instinct Mi300X Firmware, Amd Instinct Mi300X.