CVE-2024-36024

What it actually does

Race condition in AMD display driver where DMCUB commits to IPS1 during handshake, missing IPS2 transition and touching INBOX1 RPTR causing hardware hang; workaround disables idle reallow during command/gpint execution.

Why it matters to the business

Potential system instability and hardware hangs on affected Linux systems with AMD displays, increasing operational downtime risk; no known ransomware use but high ecosystem prevalence in Debian-packaged applications requires urgent patching across many deployments.

How an attack unfolds

Attacker triggers specific display command sequences during DMCUB idle transitions to induce the race, leading to hardware hang; no public exploits known despite mention of Android kernel RCE actors.

How to fix it

Update to fixed versions: thunderbird 1:115.5.0-1~deb11u1 (Debian 11), 1:115.5.0-1~deb12u1 (Debian 12), 1:115.5.0-1 (Debian 13); firefox-esr 115.5.0esr-1~deb11u1 (Debian 11), 115.5.0esr-1~deb12u1 (Debian 12), 115.5.0esr-1 (Debian 13). Apply kernel patches disabling idle reallow during command execution.

How to confirm the fix worked

Verify package versions match listed fixed releases via package manager; test display idle transitions and command execution paths under load to confirm no hardware hangs occur.

Typical attack path

1. Identify target system running vulnerable AMD display kernel code
2. Craft display command or GPINT sequence to hit the IPS1/IPS2 handshake window
3. Trigger repeated wake_and_execute operations to exploit missing reallow gap
4. Cause hardware hang and potential denial of service or further exploitation

How to detect it

Review kernel logs for AMD display driver hangs during idle or command execution; look for repeated DMCUB IPS transition failures or INBOX1 RPTR access errors in dmesg or system logs; correlate with Android kernel exploitation patterns if applicable.

• DMCUB IPS1 commit during handshake
• INBOX1 RPTR touch leading to HW hang
• back-to-back wake_and_execute without reallow gap

What your security team should do

• Prioritize upgrade of all listed Debian packages to the exact fixed versions provided due to 867 days since publication
• Monitor EPSS trend stability at 0.0016 and absence from KEV for risk prioritization
• Audit AMD-based Linux systems for the race condition exposure
• Incorporate kernel display driver updates into standard patching cycles