AMD Device Metrics Exporter: unrestricted IP binding exposes GPU configuration changes to the network
Impact
The Instinct telemetry exporter binds to all interfaces rather than a restricted address, so anything that can reach the port can make unauthorized changes to GPU configuration and knock availability down. On an Instinct fleet this exporter normally runs on every node, often as a DaemonSet alongside the ROCm stack, which means the exposure is fleet-wide rather than per-host. AMD scores it 9.2 with availability and subsequent-system availability impact and no confidentiality or integrity loss, so the realistic outcome is GPU reconfiguration and denial of service on training or inference jobs, not data theft. A GPU knocked into a bad configuration mid-job costs the whole run.
Who can reach it
Anyone with network reach to the exporter's listening port - no authentication required per the CVSS vector (AV:N/PR:N/UI:N). In practice that is any tenant workload or host on the same network segment as the metrics port unless it is firewalled.
What to do
Update AMD Device Metrics Exporter to the fixed version named in AMD-SB-6031 and restart the exporter on each node; the exporter is a userspace daemon, so no GPU reset or node reboot is implied. Until then, bind or firewall the exporter port to localhost or the management network only. The advisory is the authority on the fixed version - consult AMD-SB-6031 before scheduling.
References
Related entries
- Linux kernel amdgpu display core (DC/DM) (drm/amd/display): Memory is handed to a consumer without being initialisedCVE-2021-47348 · Linux kernel amdgpu display core (DC/DM) (drm/amd/display)Critical
- Triton Inference Server: RCE via path traversal on the model-load APICVE-2024-0087 · Triton Inference ServerCritical
- Triton Inference Server: Improper logging of security events (audit gap)CVE-2024-0095 · Triton Inference ServerCritical
- Container Toolkit: Container escape to host filesystem via TOCTOU in the **default** configurationCVE-2024-0132 · Container ToolkitCritical
- Container Toolkit: Container escape to host root via malicious image (LD_PRELOAD in OCI hook)CVE-2025-23266 · Container ToolkitCritical
- BlueField (GA firmware): out-of-bounds write in the VF command interface allows code execution on the DPUCVE-2025-23350 · BlueField (GA firmware)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.