CVE-2024-46815

What it actually does

Missing bounds check on num_valid_sets allows negative index into reader_wm_sets[] array in AMD display driver, resulting in out-of-bounds memory access and potential kernel memory corruption.

Why it matters to the business

Linux systems using AMD GPUs face elevated risk of crashes, instability, or local privilege escalation; widespread kernel deployment and listed threat actor interest increase urgency for patching despite low EPSS.

How an attack unfolds

An attacker with local access triggers the AMD display code path with num_valid_sets set to zero, causing the driver to compute a negative index and access reader_wm_sets out of bounds; listed threat actors have shown interest in similar Linux kernel memory issues.

How to fix it

Upgrade Linux kernel to commit a72d4996409569027b4609414a14a87679b12267 or equivalent stable releases containing the num_valid_sets validation; apply vendor backports promptly given 745 days since publication.

How to confirm the fix worked

Verify kernel source contains the added num_valid_sets check before reader_wm_sets access; confirm running kernel version includes the fix via uname and git describe; re-run Coverity or equivalent static analysis on patched code.

Typical attack path

1. Obtain local access on target Linux system with vulnerable AMD display driver
2. Force conditions where num_valid_sets evaluates to zero or low value
3. Invoke display-related ioctls or mode-setting operations to reach reader_wm_sets access
4. Trigger out-of-bounds read/write leading to kernel panic or memory corruption

How to detect it

Review kernel logs for AMD display driver warnings or panics mentioning reader_wm_sets or num_valid_sets; correlate with process activity invoking display ioctls; examine crash dumps for out-of-bounds access patterns in drm/amd.

What your security team should do

• Prioritize kernel updates on all AMD GPU systems within the next patch cycle
• Monitor EPSS and threat actor reports for any rise in exploitation activity
• Restrict unprivileged local access where possible until patches are deployed
• Test patched kernels in staging environments before broad rollout