CVE-2024-42123

What it actually does

Double free of the err_addr pointer occurs when amdgpu_umc_bad_page_polling_timeout invokes amdgpu_umc_handle_bad_pages multiple times under certain conditions, allowing subsequent use of the already-freed memory.

Why it matters to the business

Kernel instability or potential privilege escalation on systems with AMD GPUs may cause crashes, data corruption, or unauthorized code execution, requiring urgent patching of affected Linux distributions to maintain uptime and security.

How an attack unfolds

An attacker with local access triggers repeated bad-page polling events through crafted GPU workloads or error injection, causing the double-free condition that leads to use-after-free and potential memory corruption for code execution.

How to fix it

Update the Linux kernel to a version containing commit 8e24beb3c2b08a4763f920399a9cc577ed440a1a or later; rebuild and reboot with the patched kernel; apply vendor backports if using distribution kernels.

How to confirm the fix worked

Confirm the running kernel contains commit 8e24beb3c2b08a4763f920399a9cc577ed440a1a via git log or kernel version strings; inspect source for the NULL assignment to err_addr after handling; test bad-page polling paths under load.

Typical attack path

1. Obtain local user access on a system with vulnerable AMD GPU driver
2. Trigger amdgpu_umc_bad_page_polling_timeout through GPU error conditions or workloads
3. Force repeated calls to amdgpu_umc_handle_bad_pages without NULLing err_addr
4. Exploit the resulting double-free for memory corruption or control-flow hijacking

How to detect it

Review kernel logs for amdgpu UMC double-free warnings or use-after-free oops; search dmesg and journalctl for repeated bad-page polling messages; examine core dumps or memory debug output for freed pointer reuse.

What your security team should do

• Prioritize kernel upgrades on all AMD GPU systems within the next maintenance window
• Monitor for kernel oops or warnings related to amdgpu UMC bad-page handling
• Restrict unprivileged local access on high-value systems until patched