CVE-2024-27041

What it actually does

NULL pointer dereference in amdgpu_dm_fini() when adev->dm.dc is NULL before calls to dc_enable_dmub_notifications(), dc_deinit_callbacks(), and dc_dmub_srv_destroy() in the AMD display driver.

Why it matters to the business

Potential kernel crashes or instability on systems using AMD GPUs during driver unload or shutdown sequences, leading to unexpected downtime and reduced reliability for graphics workloads.

How an attack unfolds

An attacker with local access triggers error paths or shutdown sequences in the amdgpu driver where adev->dm.dc remains NULL, causing the kernel to dereference the pointer and panic. No known threat actors or ransomware campaigns exploit this.

How to fix it

Update the Linux kernel to a version incorporating commit e040f1fbe9abae91b12b074cfc3bbb5367b79811 which consolidates NULL checks for adev->dm.dc before the relevant dc_ functions.

How to confirm the fix worked

Verify the presence of the fix commit in the kernel source tree and confirm that amdgpu_dm_fini() now performs a single combined NULL check on adev->dm.dc prior to calling dc_enable_dmub_notifications(), dc_deinit_callbacks(), and dc_dmub_srv_destroy().

Typical attack path

1. Obtain local access to a Linux system with AMD GPU using amdgpu driver
2. Trigger driver initialization or error conditions that leave adev->dm.dc as NULL
3. Initiate driver unload or finalization sequence in amdgpu_dm_fini()
4. Execute code path reaching dc_enable_dmub_notifications() without prior NULL check
5. Cause NULL pointer dereference leading to kernel panic

How to detect it

Review kernel logs for NULL pointer dereference oops or panic entries referencing amdgpu_dm_fini or dc_enable_dmub_notifications during module unload or system shutdown.

What your security team should do

• Prioritize kernel updates containing the referenced commit on all AMD GPU systems
• Monitor for kernel oops or panic logs involving amdgpu_dm_fini during driver teardown
• Test graphics driver unload and system shutdown paths in staging environments after patching