CVE-2024-35788

What it actually does

Incorrect bounds variable (NumFclkLevelsEnabled) used for dcn35 DcfClocks array access instead of NumDcfClkLevelsEnabled, enabling out-of-bounds read/write in the AMD display driver.

Why it matters to the business

Systems with affected AMD GPUs may experience kernel instability, crashes, or potential privilege escalation; high downstream package count increases widespread exposure on Debian-based Linux distributions.

How an attack unfolds

An attacker with local access crafts display configuration or clock level inputs that trigger the dcn35 DcfClocks path, causing the driver to index beyond allocated array bounds and corrupt kernel memory.

How to fix it

Upgrade the linux package on Debian 13 to version 6.7.12-1 or later; rebuild and reboot into the patched kernel.

How to confirm the fix worked

Confirm running kernel version is 6.7.12-1 or newer; test display initialization and clock handling under load on dcn35 hardware.

Typical attack path

1. Obtain local access on a vulnerable Linux system with AMD dcn35 hardware
2. Trigger AMD display driver code paths involving DcfClocks
3. Supply clock level values exceeding the incorrect bounds check
4. Achieve out-of-bounds memory access for crash or code execution

How to detect it

Review kernel logs for AMD display driver faults or out-of-bounds warnings; correlate with display initialization events on affected hardware.

What your security team should do

• Apply the 6.7.12-1 kernel update immediately on all Debian 13 systems with AMD GPUs
• Monitor for kernel oops or panic events related to amd/display
• Prioritize systems with direct GPU access or multi-user logins