CVE-2024-46811

What it actually does

Potential out-of-bounds array access in the AMD display driver when soc.num_states exceeds the fixed size of bw_params->clk_table.entries, allowing an index overrun during bandwidth bounding box updates.

Why it matters to the business

Risk of kernel instability or crashes on systems with AMD graphics hardware under certain display configurations, with low likelihood of remote exploitation but possible impact on graphics workloads in Linux environments.

How an attack unfolds

An attacker with local access crafts display or power management states that cause soc.num_states to exceed 8, triggering the unchecked array access in fpu_update_bw_bounding_box before the added assertion halts execution.

How to fix it

Update the Linux kernel to a version containing commit 4003bac784380fed1f94f197350567eaa73a409d or later; apply the equivalent fix in any downstream distributions or stable branches that incorporate this change.

How to confirm the fix worked

Confirm the presence of the assertion check for soc.num_states > 8 in fpu_update_bw_bounding_box and verify the kernel build includes the referenced commit hash.

Typical attack path

1. Gain local code execution on a Linux system with AMD display hardware
2. Trigger display driver paths that populate soc.num_states beyond the array limit of 8
3. Invoke fpu_update_bw_bounding_box to perform the out-of-bounds indexing
4. Achieve kernel memory corruption or crash

How to detect it

Examine kernel logs for assertion failures or out-of-bounds warnings originating from the AMD display driver; correlate with display configuration changes or power state transitions.

What your security team should do

• Prioritize kernel updates on all AMD GPU systems within standard patch cycles
• Monitor for any related display driver stability issues post-update
• Review Coverity or similar static analysis results for analogous array bounds issues in display code