CVE-2023-4969

What it actually does

A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called local memory on various architectures.

Why it matters to the business

Confidential data processed on shared GPU hardware can leak between unrelated applications or users, increasing risk of information exposure in environments running dcmtk or similar GPU-accelerated tools; low EPSS and no KEV listing reduce immediate urgency but the 1004-day-old disclosure with public exploit still warrants patching.

How an attack unfolds

An attacker compiles and launches a malicious GPU kernel that targets the same local memory region used by a victim kernel running dcmtk or dependent code, reading residual sensitive data left by the victim without needing elevated privileges beyond local access.

How to fix it

Upgrade dcmtk on Debian 13 to version 3.6.8-6 or later; for GIT builds apply commit ec52e99e1e33fc39810560421c0833b02da567b3. Rebuild and redeploy any dependent GPU-accelerated applications after the update.

How to confirm the fix worked

Confirm installed package versions match or exceed the fixed releases listed above; run GPU memory isolation tests or vendor-provided validation suites to verify that cross-kernel local memory reads are no longer possible.

Typical attack path

1. Identify a target system running vulnerable dcmtk on GPU-enabled hardware
2. Obtain local user or application execution rights on the shared GPU
3. Deploy a crafted kernel that reads from GPU local memory regions
4. Extract and exfiltrate sensitive data belonging to other kernels or users

How to detect it

Review system and application logs for unexpected GPU kernel launches or memory access patterns around the time of suspected exposure; correlate with process execution records of dcmtk-related binaries and any GPU driver logs indicating cross-context memory reads.

What your security team should do

• Prioritize upgrade of all dcmtk instances to the fixed versions within standard change windows
• Inventory GPU-accelerated workloads that depend on dcmtk and schedule testing
• Monitor vendor and distribution advisories for any additional affected packages