CVE-2024-42308

What it actually does

Missing NULL check on plane_state pointer in AMD display driver allows dereference of uninitialized memory before member access.

Why it matters to the business

Systems using AMD GPUs on affected kernels risk display-related kernel crashes or instability during graphics operations, potentially leading to downtime on Debian-based servers or workstations.

How an attack unfolds

An attacker with local access crafts display plane operations that leave plane_state uninitialized, triggering a NULL dereference when the driver accesses its members, resulting in a kernel panic.

How to fix it

Upgrade the linux package on Debian 11 to version 5.10.226-1 or later to include the NULL pointer check.

How to confirm the fix worked

Verify installed kernel version is at least 5.10.226-1 and confirm the patch is present by checking for the added plane_state NULL guard in the AMD display code.

Typical attack path

1. Obtain local user access on affected Linux system with AMD GPU
2. Trigger graphics or display API calls that allocate planes without proper initialization
3. Cause the driver to access uninitialized plane_state members
4. Induce NULL pointer dereference leading to kernel crash

How to detect it

Review kernel logs for NULL pointer dereference oops in drm/amd/display code paths around plane_state handling; correlate with recent display configuration changes.

What your security team should do

• Prioritize patching all Debian 11 systems with AMD GPUs to 5.10.226-1 immediately
• Monitor for any display-related kernel oops or panics in system logs
• Restrict unprivileged local access where possible until patches are applied