EUVD-2026-30502
GHSA-g7c7-634v-gp3r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated low-complexity access (AV:N/AC:L/PR:N/UI:N); no data confidentiality/integrity loss but high availability impact on the GPU beyond the exporter itself, giving S:C with A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration, potentially resulting in loss of availability
AnalysisAI
Remote unauthenticated manipulation of AMD Instinct GPU configuration is possible in the AMD Device Metrics Exporter (DME), a ROCm-ecosystem monitoring component, because the service binds to an unrestricted IP address and exposes its control surface network-wide. Any attacker able to reach the listening port can push unauthorized GPU configuration changes, degrading or denying availability of the affected AMD Instinct MI-series accelerator (MI210/MI250/MI250X/MI300A/MI300X/MI308X/MI325X/MI350X/MI355X). No public exploit is identified at time of analysis, and EPSS is low (0.20%), but the CVSS 4.0 base score of 9.2 reflects trivial network reachability with high availability impact.
Technical ContextAI
The AMD Device Metrics Exporter is part of the ROCm software stack and functions as a metrics/telemetry endpoint (Prometheus-style exporter) for AMD Instinct datacenter GPUs, allowing operators to scrape GPU health and configuration data. The root cause is CWE-1327 (Binding to an Unrestricted IP Address): rather than binding its listener to localhost or a restricted management interface, DME binds to a wildcard address (e.g. 0.0.0.0), exposing its interface to any host that can route to it. Because the exporter also permits configuration changes to the GPU, this over-broad binding converts what should be a local/management-plane monitoring service into a network-reachable control surface. The affected hardware spans the CDNA-based AMD Instinct MI210, MI250, MI250X, MI300A, MI300X, MI308X, MI325X, MI350X, and MI355X accelerators as enumerated in the CPE data.
RemediationAI
Apply the vendor fix: upgrade the AMD Device Metrics Exporter to DME v1.4.1.2 or v1.4.0.1 (the two patched release lines named by AMD for all affected Instinct MI-series GPUs), per AMD-SB-6031 (https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6031.html). Until patched, the most direct compensating control is to restrict where DME listens and who can reach it: configure the exporter to bind only to localhost or a dedicated management interface instead of the wildcard address, and enforce firewall/network-policy rules that permit access to the DME port only from trusted monitoring collectors - the trade-off is that remote scrapers on other subnets will lose access until allow-listed. In containerized/Kubernetes deployments, avoid publishing the DME port on host-wide interfaces and use a private ClusterIP/NetworkPolicy rather than NodePort/host networking. These controls reduce exposure but do not remediate the underlying binding flaw, so treat them as interim measures pending the upgrade.
More in Amd Instinct Mi210
View allImproper cleanup of shared GPU firmware registers in AMD Instinct and Radeon Pro accelerators allows admin-privileged at
Heap-based buffer overflow in AMD's MxGPU-Virtualization (GIM) driver affects a range of AMD Instinct and Radeon PRO dat
Insufficient parameter sanitization in the AMD TEE SOC Driver's DRV_SOC_CMD_ID_SRIOV_CHECK_TA_COMPAT command handler all
A TOCTOU (Time-Of-Check to Time-Of-Use) in the graphics interface may allow an attacker to load registers repeatedly cre
Same weakness CWE-1327 – Binding to an Unrestricted IP Address
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today