CVE-2024-41011

What it actually does

The vulnerability prevents proper offset calculation when mapping the MMIO HDP page using large pages on systems with page sizes exceeding 4K, resulting in exposure of a full PAGE_SIZE region of MMIO register space instead of the intended 4K area.

Why it matters to the business

Systems running affected Linux kernels on hardware with large page sizes face potential leakage of GPU register contents to unprivileged userspace processes, increasing risk of sensitive hardware state exposure in GPU-accelerated environments.

How an attack unfolds

An attacker with sufficient privileges to request MMIO mappings through the amdkfd driver triggers the flawed large-page mapping path, causing the kernel to expose a larger-than-intended MMIO region that can be read to obtain unintended register values.

How to fix it

Update the Linux kernel to a version containing commit 009c4d78bcf07c4ac2e3dd9f275b4eaa72b4f884 or later; rebuild and deploy the updated kernel image across all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 009c4d78bcf07c4ac2e3dd9f275b4eaa72b4f884, then verify that attempts to map the HDP page with large pages are rejected or correctly limited to the intended 4K offset.

Typical attack path

1. Identify a system running an affected Linux kernel version with page size > 4K and AMD GPU support
2. Obtain access to a process that can invoke amdkfd MMIO mapping interfaces
3. Request mapping of the HDP flush registers using large pages
4. Read the erroneously exposed MMIO region to extract register contents

How to detect it

Review kernel logs and audit records for unexpected large-page MMIO mapping requests involving amdkfd or drm; examine process activity that opens /dev/kfd or performs related ioctls on systems with page size > 4K.

What your security team should do

• Prioritize kernel upgrades on all AMD GPU systems using page sizes larger than 4K
• Audit workloads that interact with amdkfd MMIO mappings and restrict untrusted access
• Monitor kernel update channels for backports of the referenced commit