CVE-2024-21969 (Whispering Pixels): Uninitialized GPU Register Access in AMD Hardware
| CVE | Component | Type | Patched | Disclosed |
|---|---|---|---|---|
| CVE-2024-21969 | AMD GPU hardware — register management | Uninitialized register access / information disclosure | Secure GPU Mode (opt-in) — June 2025 | June 23, 2025 |
Research basis: "Whispering Pixels: Exploiting Uninitialized Register Accesses in Modern GPUs."
For executives
On AMD GPUs, across the Instinct MI series and consumer hardware, GPU registers are not cleared between processes by default. CVE-2024-21969 describes a class of vulnerability where a process running on a shared AMD GPU can read register state left behind by a previous process — potentially reading pixel data, intermediate computation results, or other sensitive content from workloads that should have been isolated. AMD's fix is a new Secure GPU Mode that clears registers between processes, but it is disabled by default and degrades performance in parallel multi-process GPU environments.
The research: Whispering Pixels
GPU registers are the fastest, smallest storage in a GPU's memory hierarchy. When a shader program finishes, its register contents persist in the hardware until a new program is loaded that overwrites them. If the GPU does not explicitly clear those registers before a new program starts, the new program can read the old program's data by accessing registers it has not yet written.
The researchers named the vulnerability class for the most visually intuitive example: a GPU rendering a frame of pixel data, then a subsequent process reading the rendered pixel values from register state before those registers are overwritten.
In AI infrastructure, the analogous scenario is more consequential. A process that performed inference on a user's query may leave intermediate computation values in registers. A subsequently scheduled GPU workload can read those intermediate values, potentially including user input data, model weight values, or intermediate activations.
Affected hardware
AMD Instinct MI210, MI250, and MI300 series data centre accelerators alongside consumer AMD Radeon GPU lines. The vulnerability is architectural — it is present in the GPU hardware design itself.
AMD's mitigation: Secure GPU Mode
When Secure GPU Mode is enabled, the driver explicitly clears GPU registers between processes. It is not enabled by default. The security-performance tradeoff is explicit and direct. Organisations that share AMD GPU hardware between workloads from different users or different security domains should enable Secure GPU Mode and accept the performance penalty.