CVE-2024-35799

What it actually does

Null pointer dereference in the AMD display driver when disabling a stream encoder because the code invokes a function pointer that is no longer valid after certain display state changes.

Why it matters to the business

Local users or processes can trigger a kernel crash on affected Linux systems, causing denial of service and potential loss of graphics functionality until reboot.

How an attack unfolds

An attacker with local access triggers the stream disable path in the AMD display driver by performing display configuration changes that lead to the missing function pointer being called without a NULL check, resulting in a crash.

How to fix it

Update the Linux kernel to a version containing commit 4356a2c3f296503c8b420ae8adece053960a9f06 or later that adds the NULL check before invoking the function pointer in the disable stream encoder path.

How to confirm the fix worked

Confirm the running kernel contains the fix commit; inspect dmesg or kernel logs for the presence of the added NULL check in the AMD display driver disable stream encoder function; test display disable operations under load.

Typical attack path

1. Obtain local access on a Linux system using AMD display hardware
2. Trigger display stream disable operations through graphics APIs or configuration changes
3. Invoke the vulnerable disable stream encoder path that dereferences a NULL function pointer
4. Cause kernel panic or system crash

How to detect it

Review kernel crash dumps and dmesg logs for AMD display driver faults during stream disable operations; no widespread post-exploitation artifacts are expected.

What your security team should do

• Prioritize kernel updates on systems with AMD GPUs to the fixed version
• Restrict unprivileged local access where feasible until patched
• Monitor kernel crash reports for display-related panics as an interim indicator