CVE-2023-4969

medium

Description

A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on various architectures.

References

https://www.kb.cert.org/vuls/id/446598

https://kb.cert.org/vuls/id/446598

https://www.theregister.com/2025/04/08/patch_tuesday_microsoft/

https://github.com/Pantheon-Security/medusa

https://registry.khronos.org/vulkan/specs/1.3-extensions/html/index.html

https://registry.khronos.org/OpenCL/specs/3.0-unified/html/OpenCL_API.html#_fundamental_memory_regions

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54805

https://blog.trailofbits.com

Details

Source: Mitre, NVD

Published: 2024-01-16

Updated: 2025-06-20

Named Vulnerability: LeftoverLocals

Risk Information

CVSS v2

Base Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 6.5

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N