.webp)
Vulnerability CVE-2023-4969, nicknamed LeftoverLocals, has been disclosed by Trail of Bits. It allows a local attacker to read memory from other processes. The attacker can use a vulnerable GPU’s (Graphical Processing Unit) programmable interface to access memory that is expected to be isolated from other users and processes. Trail of Bits has proven that a GPU kernel can observe memory values from a different GPU kernel even when both are isolated between two different applications.
This vulnerability requires that an attacker create and install an application to the victim machine to record a dump of memory from a leftover application. The memory dump may contain sensitive data. The attacker can also read data from another GPU kernel while it is currently processing data. This can lead to sensitive information being leaked.
Currently AMD, Android Open Source Project, Apple, Imagination Technologies, and Red Hat are all known to be affected by this vulnerability. There are announcements from AMD, Apple, and Imagination Technologies addressing this vulnerability for their GPUs.
If you are a user of any type of GPU, review vendor announcements for firmware/driver updates to remediate this vulnerability. This is especially true for users of Apple, AMD, and Android products as you most likely will use one of those three devices.
AMD plans to roll out mitigation options beginning in March 2024 with Driver updates.
Imagination released a fix in their latest DDK release 23.3.
According to Trail of Bits, Apple provided confirmation that A17 and M3 series processors contain fixes.
Exploitation of this vulnerability can allow a local attacker to disclose sensitive data from other applications or GPU kernels. If attackers can install applications on a machine, they are more likely to be exploiting other processes. Therefore, this is unlikely to have much of an impact on business operations.
Update GPU driver: Patches are available from vendors for various GPU drivers for remediation.
Provide adequate access control: Proper controls are the best way to prevent vulnerabilities from being exploited. Deny access for local users to install applications on their own machine or from having access control to administrator privileges. If an attacker can install applications on a local machine, that’s an indication of foundational issues with your organization’s security.
https://kb.cert.org/vuls/id/446598
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6010.html
https://www.imaginationtech.com/gpu-driver-vulnerabilities/#jan24
https://github.com/trailofbits/LeftoverLocalsRelease
In December 2020, Ticketmaster was hit with a $10 million fine for an act of corporate espionage. The company had engaged in unauthorized access to a competitor's computer systems, using stolen login credentials to gather confidential business intelligence. Although this scandal broke nearly four years ago, it serves as a reminder of the legal and ethical responsibilities businesses must adhere to in today’s marketplace.
Hospitals and healthcare providers have increasingly become targets of cyberattacks, which pose significant risks to patient care and safety. This document examines the various ways in which cyberattacks can disrupt hospital operations, compromise patient data security, and ultimately affect the quality of patient care. It also explores strategies and best practices that hospitals can implement to mitigate these risks and enhance their cybersecurity posture.
Ethical hacking has become an essential response to an IT industry kept on its toes by a spectrum of bad actors with malicious intent. This article introduces two prominent methodologies that help the good guys fight back: penetration testing (pen-testing) and red teaming. Learn more here.
Host Geoff Hancock was joined by guests Mike Rush, Director of Threat Intelligence at Access Point Consulting; and Evie Manning, Senior Director of Threat Hunting and Intelligence at Access Point Consulting. Together, they talked about cyber threat intelligence and the applications that can make it work for small and medium-sized businesses.
