{"id":"UBUNTU-CVE-2023-4969","details":"A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on various architectures.","modified":"2026-03-19T09:15:38.842416Z","published":"2024-01-16T17:15:00Z","upstream":["CVE-2023-4969"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-4969"},{"type":"REPORT","url":"https://registry.khronos.org/OpenCL/specs/3.0-unified/html/OpenCL_API.html#_fundamental_memory_regions"},{"type":"REPORT","url":"https://registry.khronos.org/vulkan/specs/1.3-extensions/html/index.html"},{"type":"REPORT","url":"https://kb.cert.org/vuls/id/446598"},{"type":"REPORT","url":"https://blog.trailofbits.com"},{"type":"REPORT","url":"https://www.kb.cert.org/vuls/id/446598"},{"type":"REPORT","url":"https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6010.html"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2023-4969"}],"affected":[{"package":{"name":"linux-firmware","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/linux-firmware@1.127.24?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.116","1.117","1.118","1.119","1.121","1.122","1.123","1.124","1.125","1.126","1.127","1.127.2","1.127.3","1.127.4","1.127.5","1.127.6","1.127.7","1.127.8","1.127.10","1.127.11","1.127.12","1.127.13","1.127.14","1.127.15","1.127.16","1.127.18","1.127.19","1.127.20","1.127.22","1.127.23","1.127.24"],"ecosystem_specific":{"binaries":[{"binary_name":"linux-firmware","binary_version":"1.127.24"},{"binary_name":"nic-firmware","binary_version":"1.127.24"},{"binary_name":"scsi-firmware","binary_version":"1.127.24"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4969.json"}},{"package":{"name":"linux-firmware","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/linux-firmware@1.157.23?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.149","1.150","1.152","1.153","1.154","1.155","1.156","1.157","1.157.1","1.157.2","1.157.3","1.157.4","1.157.5","1.157.6","1.157.8","1.157.10","1.157.11","1.157.12","1.157.13","1.157.14","1.157.15","1.157.16","1.157.17","1.157.18","1.157.19","1.157.20","1.157.21","1.157.22","1.157.23"],"ecosystem_specific":{"binaries":[{"binary_name":"linux-firmware","binary_version":"1.157.23"},{"binary_name":"nic-firmware","binary_version":"1.157.23"},{"binary_name":"scsi-firmware","binary_version":"1.157.23"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4969.json"}},{"package":{"name":"linux-firmware","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/linux-firmware@1.173.21?arch=source&distro=esm-infra/bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.169","1.170","1.171","1.172","1.173","1.173.1","1.173.2","1.173.3","1.173.5","1.173.6","1.173.8","1.173.9","1.173.12","1.173.13","1.173.14","1.173.15","1.173.16","1.173.17","1.173.18","1.173.19","1.173.20","1.173.21"],"ecosystem_specific":{"binaries":[{"binary_name":"linux-firmware","binary_version":"1.173.21"},{"binary_name":"nic-firmware","binary_version":"1.173.21"},{"binary_name":"scsi-firmware","binary_version":"1.173.21"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4969.json"}},{"package":{"name":"linux-firmware","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/linux-firmware@1.187.39?arch=source&distro=esm-infra/focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.183","1.183.1","1.183.2","1.184","1.185","1.186","1.187","1.187.1","1.187.2","1.187.3","1.187.4","1.187.6","1.187.7","1.187.8","1.187.9","1.187.10","1.187.11","1.187.12","1.187.14","1.187.15","1.187.16","1.187.17","1.187.19","1.187.20","1.187.23","1.187.24","1.187.25","1.187.26","1.187.27","1.187.29","1.187.30","1.187.31","1.187.32","1.187.33","1.187.34","1.187.35","1.187.36","1.187.38","1.187.39"],"ecosystem_specific":{"binaries":[{"binary_name":"linux-firmware","binary_version":"1.187.39"},{"binary_name":"nic-firmware","binary_version":"1.187.39"},{"binary_name":"scsi-firmware","binary_version":"1.187.39"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4969.json"}},{"package":{"name":"linux-firmware","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/linux-firmware@20220329.git681281e4-0ubuntu3.41?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.201","1.202","1.204","20220124.git0c6a7b3b-0ubuntu1","20220217.git6342082c-0ubuntu1","20220217.git6342082c-0ubuntu3","20220302.gitee0667aa-0ubuntu1","20220314.gitcd01f857-0ubuntu1","20220314.gitcd01f857-0ubuntu2","20220329.git681281e4-0ubuntu1","20220329.git681281e4-0ubuntu3","20220329.git681281e4-0ubuntu3.2","20220329.git681281e4-0ubuntu3.3","20220329.git681281e4-0ubuntu3.4","20220329.git681281e4-0ubuntu3.5","20220329.git681281e4-0ubuntu3.6","20220329.git681281e4-0ubuntu3.7","20220329.git681281e4-0ubuntu3.9","20220329.git681281e4-0ubuntu3.10","20220329.git681281e4-0ubuntu3.11","20220329.git681281e4-0ubuntu3.12","20220329.git681281e4-0ubuntu3.13","20220329.git681281e4-0ubuntu3.14","20220329.git681281e4-0ubuntu3.16","20220329.git681281e4-0ubuntu3.17","20220329.git681281e4-0ubuntu3.18","20220329.git681281e4-0ubuntu3.19","20220329.git681281e4-0ubuntu3.21","20220329.git681281e4-0ubuntu3.22","20220329.git681281e4-0ubuntu3.23","20220329.git681281e4-0ubuntu3.24","20220329.git681281e4-0ubuntu3.26","20220329.git681281e4-0ubuntu3.29","20220329.git681281e4-0ubuntu3.30","20220329.git681281e4-0ubuntu3.31","20220329.git681281e4-0ubuntu3.34","20220329.git681281e4-0ubuntu3.35","20220329.git681281e4-0ubuntu3.36","20220329.git681281e4-0ubuntu3.37","20220329.git681281e4-0ubuntu3.38","20220329.git681281e4-0ubuntu3.39","20220329.git681281e4-0ubuntu3.40","20220329.git681281e4-0ubuntu3.41"],"ecosystem_specific":{"binaries":[{"binary_name":"linux-firmware","binary_version":"20220329.git681281e4-0ubuntu3.41"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4969.json"}},{"package":{"name":"linux-firmware","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/linux-firmware@20240318.git3b128b60-0ubuntu2.25?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20230919.git3672ccab-0ubuntu2.1","20230919.git3672ccab-0ubuntu2.2","20240202.git36777504-0ubuntu1","20240318.git3b128b60-0ubuntu1","20240318.git3b128b60-0ubuntu2","20240318.git3b128b60-0ubuntu2.1","20240318.git3b128b60-0ubuntu2.2","20240318.git3b128b60-0ubuntu2.3","20240318.git3b128b60-0ubuntu2.4","20240318.git3b128b60-0ubuntu2.5","20240318.git3b128b60-0ubuntu2.6","20240318.git3b128b60-0ubuntu2.7","20240318.git3b128b60-0ubuntu2.9","20240318.git3b128b60-0ubuntu2.10","20240318.git3b128b60-0ubuntu2.11","20240318.git3b128b60-0ubuntu2.12","20240318.git3b128b60-0ubuntu2.13","20240318.git3b128b60-0ubuntu2.14","20240318.git3b128b60-0ubuntu2.15","20240318.git3b128b60-0ubuntu2.17","20240318.git3b128b60-0ubuntu2.19","20240318.git3b128b60-0ubuntu2.21","20240318.git3b128b60-0ubuntu2.22","20240318.git3b128b60-0ubuntu2.23","20240318.git3b128b60-0ubuntu2.25"],"ecosystem_specific":{"binaries":[{"binary_name":"linux-firmware","binary_version":"20240318.git3b128b60-0ubuntu2.25"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4969.json"}},{"package":{"name":"linux-firmware","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/linux-firmware@20250901.git993ff19b-0ubuntu1.9?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20250317.git1d4c88ee-0ubuntu1","20250606.git3b75d677-0ubuntu1","20250701.gite2dad11e-0ubuntu1","20250711.git99d64b4f-0ubuntu1","20250807.gitb6b0b152-0ubuntu1","20250818.git07ed893d-0ubuntu1","20250901.git993ff19b-0ubuntu1","20250901.git993ff19b-0ubuntu1.2","20250901.git993ff19b-0ubuntu1.4","20250901.git993ff19b-0ubuntu1.5","20250901.git993ff19b-0ubuntu1.6","20250901.git993ff19b-0ubuntu1.7","20250901.git993ff19b-0ubuntu1.9"],"ecosystem_specific":{"binaries":[{"binary_name":"linux-firmware","binary_version":"20250901.git993ff19b-0ubuntu1.9"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-4969.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]}