CVE-2024-42074

What it actually does

Null pointer dereference in snd_acp_resume() when chip_pdev remains NULL after skipped acp platform device creation, causing kernel panic or crash.

Why it matters to the business

Systems using affected AMD audio drivers may experience unexpected crashes during resume, leading to downtime and potential data loss on Linux-based devices.

How an attack unfolds

A local attacker triggers audio resume operations on systems where ACP device initialization was skipped, causing the kernel to dereference a NULL pointer and panic.

How to fix it

Apply the upstream fix by updating to a kernel containing commit ffc253263a1375a65fa6c9f62a893e9767fbebfa or later equivalent release that includes the null check.

How to confirm the fix worked

Verify the presence of the null pointer check in snd_acp_resume() in the running kernel source or confirm the commit is included; test resume behavior on AMD ACP hardware.

Typical attack path

1. Gain local access to a vulnerable Linux system
2. Trigger or wait for audio subsystem resume events
3. Cause snd_acp_resume to execute with NULL chip_pdev
4. Trigger kernel null pointer dereference leading to panic

How to detect it

Inspect kernel logs and dmesg for null pointer dereference oops or panics mentioning snd_acp_resume or chip_pdev around resume events.

• BUG: unable to handle kernel NULL pointer dereference
• snd_acp_resume
• chip_pdev

What your security team should do

• Prioritize kernel updates containing the referenced commit for all affected AMD-based systems
• Monitor kernel logs for null dereference oops during resume events
• Test audio resume functionality post-update on representative hardware