CVE-2024-27045

What it actually does

The flaw allows snprintf to write up to 30 bytes into a 10-byte buffer in dp_dsc_clock_en_read, enabling a potential kernel buffer overflow.

Why it matters to the business

May cause kernel crashes, system instability, or local privilege escalation on Linux systems using AMD display drivers, leading to downtime or unauthorized access.

How an attack unfolds

An attacker with local access writes to the debugfs entry for dp_dsc_clock_en_read, triggering the oversized snprintf write to corrupt adjacent kernel memory.

How to fix it

Upgrade the Linux kernel to the commit ff28893c96c5e0927a4da10cd24a3522ca663515 or a later stable release that caps the snprintf at 10 bytes.

How to confirm the fix worked

Inspect drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c around line 1508 to confirm snprintf size argument is 10 rather than 30.

Typical attack path

1. Obtain local user access on an affected Linux kernel
2. Locate and interact with the AMD display debugfs interface
3. Invoke dp_dsc_clock_en_read to trigger the oversized write
4. Exploit resulting memory corruption for crash or code execution

How to detect it

Review kernel logs and debugfs interactions for calls to dp_dsc_clock_en_read that precede panics or memory corruption warnings.

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on all AMD GPU systems
• Restrict debugfs access via mount options or permissions where possible
• Monitor kernel logs for display-related oops or warnings until patched