VDB
CVE-2023-44216
CVE-2023-44216
PUBLISHED
CVSS 5.300000190734863 MEDIUM
PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing attacks against feTurbulence and feBlend in the SVG Filter specification. For example, attackers can sometimes accurately determine text contained on a web page from one origin if they control a resource from a different origin.
EPSS 1.81% · 76.5th percentile
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score
1.81%
76.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| intel | core_i7-10610u | |
| microsoft | windows_11 | |
| intel | core_i7-11800h | |
| intel | core_i7-12700k | |
| apple | macos | 13.1 |
| n/a | n/a | * |
| android | 13.0 | |
| microsoft | windows_10 | |
| intel | core_i7-8700 | |
| imaginationtech | powervr-gpu | 2018 |
| intel | core_i7-10510u | |
| canonical | ubuntu_linux | 22.04 |
| apple | m1_mac_mini | |
| nvidia | geforce_rtx_2080_super | |
| nvidia | geforce_rtx_3060 | |
| pixel_6 | ||
| amd | ryzen_7_4800u | |
| amd | ryzen_5_7600x |
Timeline
- Sep 26, 2023 CVE Published
- Sep 27, 2023 EPSS Score
- Oct 29, 2023 EPSS Score
- Nov 30, 2023 EPSS Score
- Jan 1, 2024 EPSS Score
- Mar 5, 2024 EPSS Score
- Apr 6, 2024 EPSS Score
- May 8, 2024 EPSS Score
- Jun 9, 2024 EPSS Score
- Jul 11, 2024 EPSS Score
- Aug 12, 2024 EPSS Score
- Sep 13, 2024 EPSS Score
References
- https://www.hertzbleed.com/gpu.zip/ url
- https://github.com/UT-Security/gpu-zip url
- https://blog.imaginationtech.com/introducing-pvric4-taking-image-compression-to-the-next-level/ url
- https://news.ycombinator.com/item?id=37663159 url
- https://www.hertzbleed.com/gpu.zip/GPU-zip.pdf url
- https://www.w3.org/TR/filter-effects-1/ url
- https://blog.imaginationtech.com/reducing-bandwidth-pvric/ url
- https://arstechnica.com/security/2023/09/gpus-from-all-major-suppliers-are-vulnerable-to-new-pixel-stealing-attack/ url
- https://www.bleepingcomputer.com/news/security/modern-gpus-vulnerable-to-new-gpuzip-side-channel-attack/ url
- https://nvd.nist.gov/vuln/detail/CVE-2023-44216 advisory
- https://arstechnica.com/security/2023/09/gpus-from-all-major-suppliers-are-vulnerable-to-new-pixel-stealing-attack url
- https://blog.imaginationtech.com/introducing-pvric4-taking-image-compression-to-the-next-level url
- https://blog.imaginationtech.com/reducing-bandwidth-pvric url
- https://www.bleepingcomputer.com/news/security/modern-gpus-vulnerable-to-new-gpuzip-side-channel-attack url
- https://www.hertzbleed.com/gpu.zip url
- https://www.w3.org/TR/filter-effects-1 url