CVE-2024-46724

What it actually does

Unchecked fb_channel_number value allows an out-of-bounds array read inside the AMDGPU driver's df_v1_7 handling code, potentially exposing adjacent kernel memory.

Why it matters to the business

Systems using AMD GPUs may experience kernel crashes, denial of service, or limited information disclosure, increasing downtime and support costs for organizations running vulnerable Linux kernels.

How an attack unfolds

An attacker with local access crafts graphics or display operations that reach the vulnerable df_v1_7_channel_number path without triggering the missing bounds check, reading past the intended array.

How to fix it

Update the Linux kernel to a version containing commit 725b728cc0c8c5fafdfb51cb0937870d33a40fa4 or later; rebuild and reboot with the patched kernel on all affected AMD systems.

How to confirm the fix worked

Confirm the running kernel contains commit 725b728cc0c8c5fafdfb51cb0937870d33a40fa4; inspect the amdgpu df_v1_7 code for the added fb_channel_number range check; test display initialization on AMD hardware.

Typical attack path

1. Obtain local user privileges on a system with an affected AMDGPU driver
2. Trigger DRM/amdgpu code paths that populate fb_channel_number with an out-of-range value
3. Read kernel memory beyond the intended array boundary
4. Leverage disclosed data or resulting instability for further attacks

How to detect it

Review kernel logs for amdgpu-related out-of-bounds warnings or panics around df_v1_7_channel_number; correlate with recent display or graphics activity from untrusted processes.

What your security team should do

• Apply the referenced kernel commit or newer release immediately on all AMDGPU systems
• Prioritize patching servers and workstations with discrete AMD graphics
• Monitor for kernel oops or panic logs mentioning amdgpu and df_v1_7 after deployment