.webp)
Vulnerability CVE-2023-4969, nicknamed LeftoverLocals, has been disclosed by Trail of Bits. It allows a local attacker to read memory from other processes. The attacker can use a vulnerable GPU’s (Graphical Processing Unit) programmable interface to access memory that is expected to be isolated from other users and processes. Trail of Bits has proven that a GPU kernel can observe memory values from a different GPU kernel even when both are isolated between two different applications.
This vulnerability requires that an attacker create and install an application to the victim machine to record a dump of memory from a leftover application. The memory dump may contain sensitive data. The attacker can also read data from another GPU kernel while it is currently processing data. This can lead to sensitive information being leaked.
Currently AMD, Android Open Source Project, Apple, Imagination Technologies, and Red Hat are all known to be affected by this vulnerability. There are announcements from AMD, Apple, and Imagination Technologies addressing this vulnerability for their GPUs.
If you are a user of any type of GPU, review vendor announcements for firmware/driver updates to remediate this vulnerability. This is especially true for users of Apple, AMD, and Android products as you most likely will use one of those three devices.
AMD plans to roll out mitigation options beginning in March 2024 with Driver updates.
Imagination released a fix in their latest DDK release 23.3.
According to Trail of Bits, Apple provided confirmation that A17 and M3 series processors contain fixes.
Exploitation of this vulnerability can allow a local attacker to disclose sensitive data from other applications or GPU kernels. If attackers can install applications on a machine, they are more likely to be exploiting other processes. Therefore, this is unlikely to have much of an impact on business operations.
Update GPU driver: Patches are available from vendors for various GPU drivers for remediation.
Provide adequate access control: Proper controls are the best way to prevent vulnerabilities from being exploited. Deny access for local users to install applications on their own machine or from having access control to administrator privileges. If an attacker can install applications on a local machine, that’s an indication of foundational issues with your organization’s security.
https://kb.cert.org/vuls/id/446598
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6010.html
https://www.imaginationtech.com/gpu-driver-vulnerabilities/#jan24
https://github.com/trailofbits/LeftoverLocalsRelease
On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.
As we conclude our 'ransomware readiness week' of this Cybersecurity Awareness Month, it's time to take a critical look at your organization's defenses. Ransomware attacks are becoming more sophisticated, and no business is immune. In our latest article, we explore essential strategies to bolster your ransomware preparedness. Don't miss this vital information to help protect your business from emerging threats.
Ethical hacking has become an essential response to an IT industry kept on its toes by a spectrum of bad actors with malicious intent. This article introduces two prominent methodologies that help the good guys fight back: penetration testing (pen-testing) and red teaming. Learn more here.
Host Geoff Hancock was joined by guests Mike Rush, Director of Threat Intelligence at Access Point Consulting; and Evie Manning, Senior Director of Threat Hunting and Intelligence at Access Point Consulting. Together, they talked about cyber threat intelligence and the applications that can make it work for small and medium-sized businesses.
