CVE-2024-46772

What it actually does

Missing validation allows a zero denominator (crb_pipes) to reach a division operation in the AMD display driver, triggering divide-by-zero faults in the Linux kernel.

Why it matters to the business

Local users can cause kernel crashes or unexpected reboots on affected systems, leading to downtime and potential loss of unsaved work; the low EPSS and lack of KEV listing indicate limited remote risk but still require prompt patching on Linux distributions using the AMD display stack.

How an attack unfolds

An attacker with local access crafts graphics or display configuration inputs that set crb_pipes to zero; when the driver performs the unchecked division, the kernel faults. No public exploit code or ransomware campaigns are associated, though related Linux kernel issues have been referenced by threat actors.

How to fix it

Update the Linux kernel to commit 04805efe8623f8721f3c01182ea73d68e88c62d8 or later stable releases containing the denominator check; for the listed etcd package update to 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4 if that component is in use.

How to confirm the fix worked

Confirm the patch is present by inspecting the drm/amd/display source for the added crb_pipes != 0 check, or verify the running kernel version contains the referenced commit; recompile and test display initialization paths under load.

Typical attack path

1. Obtain local shell or user session on a vulnerable Linux system with AMD display hardware
2. Trigger display driver paths that compute crb_pipes without prior zero check
3. Cause division-by-zero fault resulting in kernel oops or panic

How to detect it

Review kernel logs for divide-by-zero faults originating from amd/display or drm code paths; correlate with graphics configuration changes or display driver initialization events.

What your security team should do

• Prioritize kernel updates on all AMD-based Linux hosts within the next maintenance window
• Monitor for related Linux kernel privilege-escalation activity referenced by threat actors
• Apply the fix across fleets before the CISA-style deadlines if the issue later enters KEV