CVE-2022-48979

What it actually does

Array index out-of-bounds access in the DCN32 DML code path of the AMD display driver, where LinkCapacitySupport is indexed by voltage state count instead of max DPP count, enabling memory corruption.

Why it matters to the business

Linux systems with affected AMD GPUs may suffer kernel crashes, display instability, or local privilege escalation; widespread kernel deployment means broad operational risk across servers and workstations even 726 days after disclosure.

How an attack unfolds

A local attacker manipulates display configuration or voltage state parameters to trigger the incorrect array indexing in DCN32 DML, causing an out-of-bounds read/write that can be leveraged for memory corruption and code execution; listed espionage and financially motivated actors have shown interest in similar Linux kernel graphics flaws.

How to fix it

Upgrade the Linux kernel to a revision containing commit 3d8a298b2e83b98042e6ec726e934f535b23e6aa (or the equivalent stable backport 43896a47de4e05ac94ec0472c220da944da16c5c) and reboot.

How to confirm the fix worked

Confirm the fix commit is present in the running kernel source tree or verify the kernel package version is newer than the vulnerable commits listed for the affected git repositories.

Typical attack path

1. Obtain local access on a system running a vulnerable Linux kernel with AMD DCN32 hardware
2. Trigger display mode or voltage state transitions that exceed expected array bounds
3. Force out-of-bounds access to LinkCapacitySupport
4. Corrupt adjacent kernel memory to achieve denial of service or privilege escalation

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for DCN32 DML array bound errors or LinkCapacitySupport references around the time of suspected exploitation; correlate with display subsystem activity.

• array index out of bound error in DCN32 DML
• LinkCapacitySupport
• dcn32_dml

What your security team should do

• Apply the referenced kernel fixes to all AMD DCN32 systems within the next maintenance window
• Prioritize patching on multi-user and internet-facing Linux hosts given documented interest from espionage actors
• Reboot after upgrade and monitor for display-related kernel oops or panics during the rollout