CVE-2024-43904

What it actually does

Null pointer dereference in dcn30_apply_idle_power_optimizations when stream or plane pointers assumed non-null are later dereferenced without checks, causing kernel crash.

Why it matters to the business

Unexpected system crashes or reboots on Linux systems using affected AMD display hardware, leading to downtime and potential data loss for workloads relying on graphics stability.

How an attack unfolds

An attacker with local access triggers the idle power optimization path in the AMD display driver under conditions where stream or plane structures are null, resulting in a kernel panic; no widespread remote exploitation observed despite mentions in broad 2024 kernel vulnerability campaigns.

How to fix it

Update to Linux kernel commit fcf9d6a9f30ea414b6b84a6e901cebd44e146847 or later; Android devices should apply the 2022-12-01 security patches for versions 10 through 13 that include the equivalent null checks.

How to confirm the fix worked

Confirm kernel source contains the added null checks for stream and plane before lines 938-940 in dcn30_hwseq.c; verify running kernel version includes the fix commit or later stable backport.

Typical attack path

1. Obtain local code execution on target Linux system with AMD GPU
2. Trigger display idle power optimization code path
3. Supply or induce null stream/plane state to reach unchecked dereference
4. Cause kernel panic and system crash

How to detect it

Review kernel logs for null pointer dereference oops in dcn30_hwseq.c or amdgpu display driver; correlate with AMD GPU idle power state transitions.

What your security team should do

• Prioritize kernel upgrades on all AMD GPU-equipped Linux hosts within 30 days given publication date
• Monitor for kernel oops/panic reports referencing dcn30_apply_idle_power_optimizations
• Apply Android security patches to affected mobile devices