CVE-2024-36897

What it actually does

Null pointer dereference in the Linux kernel AMD display driver (drm/amd/display) when DAL parses Atom Integrated System Info from BIOS version 2.3, because integrated_info remains NULL.

Why it matters to the business

Affected Linux systems with AMD graphics may experience sudden kernel crashes or display initialization failures, leading to downtime on servers, workstations, or embedded devices.

How an attack unfolds

A local attacker triggers the display driver initialization code path that encounters a new BIOS version 2.3 structure; the missing case leaves integrated_info NULL and the subsequent dereference causes an oops or panic.

How to fix it

Apply the upstream fix by updating to a kernel containing commit 3c7013a87124bab54216d9b99f77e8b6de6fbc1a, which adds the missing case for BIOS version 2.3 in Atom Integrated System Info v2_2 handling for DCN35.

How to confirm the fix worked

Confirm the patch is present by inspecting the drm/amd/display source for the v2_3 BIOS case or by running a kernel that includes commit 3c7013a87124bab54216d9b99f77e8b6de6fbc1a and verifying no null dereference occurs on affected hardware.

Typical attack path

1. Obtain local user access on a Linux system using the vulnerable AMD display driver
2. Trigger display driver load or mode-set operations that invoke BIOS parsing for integrated system info
3. Cause the null dereference during Ctx->dc_bios->integrated_info access
4. Result in kernel crash or denial of service

How to detect it

Search kernel logs and dmesg for null pointer dereference or oops entries involving drm/amd/display, dc_bios, or integrated_info during display initialization.

What your security team should do

• Prioritize kernel updates containing the referenced commit on all AMD GPU systems
• Test the updated kernel on representative hardware before broad deployment
• Monitor kernel logs for oops messages referencing dc_bios or integrated_info