PT-2023-29149 · Imagination Technologies · Imagination Gpu

Published 2023-09-26 · Updated 2023-10-05 · CVE-2023-44216

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Imagination GPU devices versions 2018 and later

Description The issue allows for cross-origin pixel-stealing attacks against certain functions in the SVG Filter specification, such as feTurbulence and feBlend. This can enable attackers to determine text contained on a web page from one origin if they control a resource from a different origin.

Recommendations For Imagination GPU devices versions 2018 and later, consider disabling the PVRIC (PowerVR Image Compression) feature as a temporary workaround until a patch is available. Restrict access to sensitive resources to minimize the risk of exploitation. Avoid using the feTurbulence and feBlend functions in the SVG Filter specification until the issue is resolved.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2023-44216

Affected Products

Imagination Gpu

References · 15

• 🔥 https://hertzbleed.com/gpu.zip/GPU-zip.pdf · Exploit
• 🔥 https://w3.org/TR/filter-effects-1 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-44216 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-44216 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44216 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-44216 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44216 · Vendor Advisory
• https://github.com/UT-Security/gpu-zip · Note
• https://blog.imaginationtech.com/reducing-bandwidth-pvric · Note
• https://arstechnica.com/security/2023/09/gpus-from-all-major-suppliers-are-vulnerable-to-new-pixel-stealing-attack · Note
• https://news.ycombinator.com/item?id=37663159 · Note
• https://bleepingcomputer.com/news/security/modern-gpus-vulnerable-to-new-gpuzip-side-channel-attack · Note
• https://hertzbleed.com/gpu.zip · Note
• https://twitter.com/CVEnew/status/1706789095417229681 · Twitter Post
• https://blog.imaginationtech.com/introducing-pvric4-taking-image-compression-to-the-next-level · Note