CVE-2024-46730

What it actually does

Negative array index (tg_inst = -1) when timing_generator_count equals zero leads to out-of-bounds memory access and potential buffer overrun in the AMD display timing-generator code path.

Why it matters to the business

Local denial-of-service or kernel instability on systems using affected AMD GPUs; widespread Linux distributions and downstream projects such as KubeEdge increase operational exposure until patches are applied.

How an attack unfolds

An attacker with local access triggers the AMD display driver initialization or mode-setting code when no timing generators are present, causing the unchecked negative index to be used as an array subscript and resulting in an overrun condition.

How to fix it

Update the Linux kernel to a commit containing a64284b9e1999ad5580debced4bc6d6adb28aad4 or later; for KubeEdge deployments apply versions 1.11.1, 1.10.2 or 1.9.4.

How to confirm the fix worked

Verify the presence of the added bounds check before tg_inst is used; confirm kernel version contains the referenced commit or run static-analysis tools against the drm/amd/display sources.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Trigger AMD display driver paths that read timing_generator_count
3. Force timing_generator_count to zero
4. Pass the resulting negative tg_inst value to array indexing logic
5. Cause memory overrun leading to crash or corruption

How to detect it

Review kernel logs for AMD display driver oops or panic messages mentioning timing generators or array indexing faults; correlate with processes exercising display initialization.

What your security team should do

• Prioritize kernel package updates on all AMD GPU hosts
• Apply the listed KubeEdge point releases where the component is used
• Test updated kernels in staging before broad deployment
• Monitor vendor advisories for additional backports