CVE-2024-42228

What it actually does

Uninitialized *size value passed to amdgpu_vce_cs_reloc in the AMDGPU DRM driver can result in out-of-bounds memory access or corruption when handling command stream relocations such as case 0x03000001.

Why it matters to the business

Local attackers on systems with AMD GPUs may cause kernel crashes, data corruption, or privilege escalation, leading to downtime, potential data loss, and the need for urgent kernel updates across fleets of Linux servers and workstations.

How an attack unfolds

An attacker with local access crafts a malicious userspace command stream that triggers the uninitialized size path in the VCE command submission code; the kernel then uses the garbage value for relocation calculations, enabling memory corruption that can be leveraged for code execution.

How to fix it

Update the Linux kernel to a version containing commit d35cf41c8eb5d9fe95b21ae6ee2910f9ba4878e8 which initializes the size variable before the amdgpu_vce_cs_reloc call; rebuild and deploy the fixed kernel across all affected systems.

How to confirm the fix worked

Verify the presence of the initialization patch in the amdgpu_vce.c source or confirm the running kernel was built after commit d35cf41c8eb5d9fe95b21ae6ee2910f9ba4878e8; test command submission paths that previously exercised the uninitialized size case.

Typical attack path

1. Obtain local user access on a Linux system with AMDGPU hardware
2. Load or trigger the amdgpu driver and submit a specially crafted VCE command stream containing case 0x03000001
3. Trigger the code path that calls amdgpu_vce_cs_reloc with uninitialized size
4. Exploit resulting memory corruption to achieve kernel read/write or code execution

How to detect it

Search kernel logs and crash reports for amdgpu VCE command submission errors or oopses referencing vce_cs_reloc; look for unusual command stream submissions from userspace processes interacting with /dev/dri.

• amdgpu_vce_cs_reloc
• case 0x03000001
• drm/amdgpu: Using uninitialized value

What your security team should do

• Immediately prioritize kernel updates containing the referenced commit on all AMDGPU-equipped systems
• Monitor vendor kernel advisories for backported fixes in distribution kernels
• Restrict unprivileged local access where feasible until patches are applied
• Include the amdgpu driver in routine kernel vulnerability scanning and update processes