An exploit for the AMD Device Metrics Exporter in the ROCm ecosystem permits a remote attacker to bind to any IP address and authorize changes to GPU configuration settings. The vulnerability, identified as CWE-1327, could allow an attacker to modify or disable GPU operational parameters, directly impacting system availability by disrupting compute workloads or rendering the GPU unusable.

AMD Instinct products affected include the MI210, MI250, MI250X, MI300A, MI300X, MI308X, MI325X, MI350X, and MI355X. No specific version ranges are listed, so all current releases of these GPUs that include the ROCm Device Metrics Exporter are considered vulnerable.

The CVSS score of 9.2 indicates a high severity issue. EPSS data is not provided, and the vulnerability is not listed in the CISA KEV catalog, but the remote nature of the exporter suggests that the attack is feasible over a network. The likely attack vector is remote, with an attacker potentially controlling GPU configuration without local access. Given the critical role of GPUs in many workloads, the risk is high and the potential for widespread service disruption is significant.