Summary
Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
How do I check my Azure Machine Learning Compute Instance runtime version?
To determine your runtime version, make a GET compute rest API call for your compute instance, then check the response. You can find the runtime version from field *versions.runtime. *
Please view additional details here: https://learn.microsoft.com/en-us/rest/api/azureml/2023-04-01/compute/get
Please reference the guidance provided here: https://learn.microsoft.com/en-us/rest/api/azureml/2023-04-01/compute/update
What type of information could be disclosed by this vulnerability?
An attacker that successfully exploited this vulnerability could recover any data that is put in the system logs on the Compute Instance including cleartext passwords.
According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
An attacker must be authenticated and have read privileges to the logs which may contain sensitive information such as cleartext passwords. It does not require admin or other elevated privileges.
Security updates
3.0.02076.0001 — https://azure.microsoft.com/en-us/products/machine-learning/
Vulnerabilities 1
-
Medium 6.5
Azure Machine Learning Compute Instance Information Disclosure Vulnerability
Azure Machine Learning Compute Instance Information Disclosure Vulnerability
Revision history
-
#3
Corrected one or more links in the FAQ. This is an informational change only.
-
#2
Added FAQ information. This is an informational change only.
-
#1
Information published.
References
-
CVE-2023-23382 Azure Machine Learning Compute Instance Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23382
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss