CVE-2024-43907

What it actually does

Null pointer dereference in drm/amdgpu/pm apply_state_adjust_rules when a required pointer is unchecked before use, resulting in memory corruption or kernel panic on AMD GPUs.

Why it matters to the business

Unexpected system crashes or instability on Linux systems using AMD graphics hardware, leading to downtime and potential data loss until patched; high prevalence in Debian-based distributions increases exposure for servers and workstations.

How an attack unfolds

An attacker with local access crafts or triggers a power management state transition in the AMDGPU driver that passes a null pointer into apply_state_adjust_rules, causing the dereference and system crash; no widespread remote exploitation observed but local privilege escalation or denial-of-service possible in targeted scenarios involving Linux kernel resource handling.

How to fix it

Upgrade the linux package to version 6.9.7-1 or later on Debian 13 systems; apply kernel updates from distribution repositories and reboot to load the fixed driver.

How to confirm the fix worked

Verify installed linux package version is at least 6.9.7-1 using package manager queries; confirm absence of the vulnerable apply_state_adjust_rules code path via kernel source inspection or runtime testing on AMD hardware.

Typical attack path

1. Gain local access to a Linux system with AMD GPU
2. Trigger AMDGPU power management state changes via userspace tools or workloads
3. Supply input that leaves required structure pointer null
4. Execute code path reaching apply_state_adjust_rules without null check
5. Induce kernel panic or memory corruption

How to detect it

Review kernel logs for amdgpu null pointer dereference oops or panic entries around power management events; correlate with AMD GPU usage spikes or state transitions in system audit logs.

What your security team should do

• Prioritize patching Debian 13 systems with AMD GPUs within standard maintenance windows due to memory corruption risk
• Monitor for kernel oops or panic logs related to amdgpu pm after deployment
• Restrict untrusted local user access on multi-tenant systems until updated