CVE-2023-4969: GPU kernel implementations susceptible to memory leak

Reference Links

• https://www.bleepingcomputer.com/news/security/amd-apple-qualcomm-gpus-leak-ai-data-in-leftoverlocals-attacks/
• https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-chromeos_16.html (Advisory)
• https://registry.khronos.org/OpenCL/specs/3.0-unified/html/OpenCL_API.html#_fundamental_memory_regions
• https://registry.khronos.org/vulkan/specs/1.3-extensions/html/index.html
• https://kb.cert.org/vuls/id/446598
• https://blog.trailofbits.com
• https://www.kb.cert.org/vuls/id/446598
• https://www.theregister.com/2024/01/17/leftoverlocals_gpu_flaw/

Parent vulnerabilities

(Appears in the following advisories)

• 7463221090388839304

Frequently Asked Questions

• What is the severity of CVE-2023-4969?

  The severity of CVE-2023-4969 is classified as high due to the potential for sensitive data exposure between GPU kernels.

• How do I fix CVE-2023-4969?

  Fixing CVE-2023-4969 typically involves updating the affected GPU drivers from vendors like Apple, Qualcomm, and AMD.

• What types of software are affected by CVE-2023-4969?

  CVE-2023-4969 affects GPU drivers from vendors such as Apple, Qualcomm, AMD, and Imagination, as well as implementations of OpenCL and Vulkan APIs.

• What kind of data can be leaked due to CVE-2023-4969?

  CVE-2023-4969 allows sensitive data from one GPU kernel to be read by another, which may include user data from different applications or contexts.

• Is CVE-2023-4969 likely to be exploited?

  Given the high severity and the nature of the vulnerability, CVE-2023-4969 is likely to be targeted by attackers looking to exploit GPU memory handling.