CVE-2023-4969 — LeftoverLocals: Missing Release of Memory after Effective Lifetime in Firmware-nonfree

CWE-401 — Missing Release of Memory after Effective Lifetime11 documents10 sources
Severity
6.5MEDIUMNVD
EPSS
2.1%
top 16.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Debian Firmware-nonfreeKhronos Group OpenclKhronos Group Vulkan+4 more
Timeline
PublishedJan 16
Latest updateJan 29

Description

A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on various architectures.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NExploitability: 2.0 | Impact: 4.0

Affected Packages7 packages

▶debiandebian/firmware-nonfree< firmware-nonfree 20240610-1 (forky)
▶NVDkhronos/opencl3.0.11
▶NVDkhronos/vulkan1.3.224
▶CVEListV5khronos_group/opencl3.0.11 — 3.0.11

🔴Vulnerability Details

2
GHSA
GHSA-95ph-5wpx-w6gq: A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memo↗2024-01-16
▶
OSV
CVE-2023-4969: A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memo↗2024-01-16
▶

📋Vendor Advisories

3
Chrome
Long Term Support Channel Update for ChromeOS: CVE-2023-4969↗2024-01-18
▶
Red Hat
hw: amd: GPU memory leaks↗2024-01-16
▶
Debian
CVE-2023-4969: firmware-nonfree - A GPU kernel can read sensitive data from another GPU kernel (even from another ...↗2023
▶

🕵️Threat Intelligence

3
Bleepingcomputer
AMD, Apple, Qualcomm GPUs leak AI data in LeftoverLocals attacks↗2024-01-17
▶
Trailofbits
LeftoverLocals: Listening to LLM responses through leaked GPU local memory↗2024-01-16
▶
Trailofbits
LeftoverLocals: Listening to LLM responses through leaked GPU local memory↗2024-01-16
▶

📄Research Papers

1
arXiv
LeftoverLocals: Listening to LLM Responses Through Leaked GPU Local Memory↗2024-01-29
▶

💬Community

1
Bugzilla
CVE-2023-4969 hw: amd: GPU memory leaks↗2023-12-04
▶