CVE-2022-48849

What it actually does

The amdgpu driver performs an unnecessary tiling flag validation based on framebuffer format modifiers even when virtual display mode is active, which vkms and similar virtual displays do not support; this triggers a kernel warning and can allow improperly validated framebuffer objects to be initialized.

Why it matters to the business

Local users on systems using AMD GPUs with virtual display or vkms enabled may experience graphics stack instability or kernel warnings that disrupt normal operation; the large number of Linux kernel dependents increases exposure across servers, desktops, and embedded devices, though the issue is not known to be actively exploited in ransomware.

How an attack unfolds

An attacker with local access crafts or triggers framebuffer creation under virtual display conditions; the missing bypass of the modifier-based tiling check causes the validation path to fail, resulting in a warning or integrity violation that the attacker can leverage for further local impact.

How to fix it

Update the Linux kernel to a version containing commit cb29021be49858059138f75d6311a7c35a9379b2 or later; rebuild and reboot with the patched amdgpu driver; for distributions without the commit, apply the equivalent backport that checks adev->enable_virtual_display before the modifier validation.

How to confirm the fix worked

Confirm the presence of cb29021be49858059138f75d6311a7c35a9379b2 in the running kernel source or package; verify that amdgpu_display_framebuffer_init no longer emits the GFX9+ requires FB check warning when virtual display is active; run kernel regression tests involving vkms framebuffer creation.

Typical attack path

1. Obtain local user access on a Linux system with amdgpu and virtual display enabled
2. Trigger or influence DRM framebuffer initialization through vkms or similar virtual display paths
3. Force the code path in amdgpu_display_framebuffer_init that performs the unsupported tiling flag check
4. Observe resulting kernel warning or exploit the improper validation for integrity impact

How to detect it

Search kernel logs and dmesg for the string 'GFX9+ requires FB check based on format modifier' and the function amdgpu_display_framebuffer_init; inspect audit logs for unusual local processes creating DRM framebuffers under virtual display configurations.

• GFX9+ requires FB check based on format modifier
• amdgpu_display_framebuffer_init
• WARNING: CPU:.*amdgpu.*virtual display

What your security team should do

• Prioritize kernel updates on all AMD GPU systems using virtual displays or vkms within the next maintenance window
• Monitor for the specific warning string in dmesg and kernel logs on affected hosts
• Restrict local access for untrusted users until patches are applied where virtual display is enabled
• Review downstream kernel packages for inclusion of the referenced commit