CVE-2022-48710

What it actually does

Unchecked return value from drm_mode_duplicate() in radeon_fp_native_mode() and drm_cvt_mode() leads to null pointer dereference in the Linux kernel DRM Radeon driver.

Why it matters to the business

Systems using affected Linux kernel versions with Radeon graphics hardware may experience unexpected crashes or instability, potentially disrupting operations until patched.

How an attack unfolds

An attacker with local access triggers the radeon display mode handling code path where drm_mode_duplicate() fails to allocate, resulting in a subsequent null dereference and kernel panic.

How to fix it

Update the Linux kernel to include commit b33f7d99c9226892c7794dc2500fae35966020c9 or later stable releases that resolve the null pointer checks in drm/radeon.

How to confirm the fix worked

Verify kernel source contains the null checks after drm_mode_duplicate() and drm_cvt_mode() calls, or confirm running kernel version includes the referenced commit.

Typical attack path

1. Obtain local access to a Linux system with Radeon GPU
2. Trigger display mode configuration or native mode handling in the radeon driver
3. Force drm_mode_duplicate() or drm_cvt_mode() to fail allocation
4. Trigger null pointer dereference causing kernel crash

How to detect it

Inspect kernel logs and crash dumps for null pointer dereference oops involving radeon_fp_native_mode or drm_mode_duplicate functions.

• radeon_fp_native_mode
• drm_mode_duplicate
• NULL pointer dereference in drm/radeon

What your security team should do

• Prioritize kernel upgrades on systems with Radeon hardware
• Monitor for kernel oops or panic reports related to radeon driver
• Apply updates before any scheduled maintenance windows involving graphics configuration