Cross-Origin Pixel-Stealing Vulnerability in Imagination GPUs
CVE-2023-44216

5.3MEDIUM

Key Information:

Vendor

Canonical

Status
Ubuntu Linux
Ryzen 7 4800u
Core I7-10510u
Core I7-12700k
Vendor
CVE Published:
27 September 2023

What is CVE-2023-44216?

Imagination's PowerVR Image Compression technology on its GPUs, developed in 2018 and later, is susceptible to a cross-origin pixel-stealing vulnerability. This flaw allows attackers to exploit the feTurbulence and feBlend features specified in SVG filters, resulting in the unauthorized extraction of sensitive information from web pages. By controlling a resource from a different origin, attackers can infer text and other data from the targeted web page, raising significant privacy and security concerns for users relying on affected GPU hardware.

References

https://www.hertzbleed.com/gpu.zip/
https://www.hertzbleed.com/gpu.zip/GPU-zip.pdf
https://github.com/UT-Security/gpu-zip

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-44216 : Cross-Origin Pixel-Stealing Vulnerability in Imagination GPUs