Preface: “LeftoverLocals” allows recovery of data from GPU local memory created by other processes on Apple, Qualcomm, AMD, and Imagination GPUs. LeftoverLocals affects the security posture of the entire GPU application, especially LLM and machine learning models running on affected GPU platforms. NVD published on January 16, 2024. So far, AMD appears to be the only company actively taking remediation measures.
Background: Researchers from Trail of Bits reported a potential vulnerability, titled “LeftoverLocals” article to public on 16th January 2024. The corrective action was taken by AMD in following schedule.
2025-07-18: Updated the Mitigation section for AMD Radeon Graphics
2025-06-23: Updated the Mitigation section for Data Center Graphics, AMD Radeon Graphics, and revised Client Processors table
2025-04-07: Updated the Mitigation section for Data Center Graphics, AMD Radeon Graphics, and Client Processors
2025-02-11: Updated the Mitigation section – Data Center Graphics
2025-01-15: Mitigation section has been updated and AMD Ryzen™ AI 300 Series Processor (Formerly codenamed) “Strix Point” FP8 has been added to the Client Processors list
2024-11-07: Mitigation has been updated for MI300 and MI300A
Updated driver version from 24.x.y to 25.x.y
2024-10-30: Updated mitigation targets
2024-08-02: Updated AMD Software: Adrenalin Edition and PRO Edition versions.
Removed: AMD Ryzen™ 3000 Series Processors with Radeon™ Graphics (Not affected)
Added: AMD Ryzen™ 8000 Series Processors with Radeon™ Graphics and AMD Ryzen™ 7030 Series Processors with Radeon™ Graphics
2024-07-30: Updated the Mitigation section of AMD RadeonTM Graphics and Client processors product tables
Updated Data Center Graphics Inter-VM and Bare Metal/Intra-VM Mitigation product tables
Updated mitigation section month for driver update rollout
2024-05-07: Added Vega products and Mitigation section with Product tables
2024-01-26: Updated Graphics and Data Center Graphics products
2024-01-16: Initial publication
Vulnerability details: CVE-2023-4969: A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on various architectures.
Official announcement: Please refer to the official link for details – https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6010.html
Remark: In step 5, CU2 is written incorrectly. The correct word should be CU.