Thank you, Salvatore.I'd never seen a CVE before on a ROCm package, so it's taken some time to understand the process. The bug was fixed upstream in ROCm 7.14. I've confirmed the commit for the upstream fix [1], but have not yet verified if this bug affects ROCm 5.4.3, or if it is feasible to backport the fix.
Sincerely, Cory Bloor[1]: https://github.com/ROCm/rocm-systems/commit/ccba298bcfb644246e07b1137e948a4cab60eb29
