AMD Device Metrics Exporter Unrestricted IP Address Binding Vulnerability Allowing Unauthorized GPU Configuration Changes

A vulnerability exists in the AMD Device Metrics Exporter, part of the ROCm ecosystem, due to unrestricted IP address binding. This issue allows remote, unauthenticated attackers to access the GPU-Agent gRPC server on port 50061, exposed on all network interfaces by default. The vulnerability is present only in Debian package deployments, not in Docker or Kubernetes environments. Exploitation could lead to unauthorized modifications of GPU configurations, potentially causing disruptions in availability.

Impact

Exploitation of this vulnerability could result in unauthorized changes to GPU configurations, disrupting availability.

Remediation

Users are advised to upgrade to version 1.4.1.2 for ROCm 7.1.x or version 1.4.0.1 for ROCm 7.0.x. For those on older ROCm releases, it is recommended to isolate the process within a network namespace or apply external firewall rules to restrict access.