CVE-2024-47662

What it actually does

The Linux kernel AMD display driver incorrectly reads a DCN35 DMCUB register during diagnostic collection on work timeout, triggering a security violation that blocks Z8 power state entry.

Why it matters to the business

Kernel-level power management failures can cause elevated power draw, system instability, and blocked low-power states on affected AMD hardware; low EPSS and no KEV status indicate limited immediate operational urgency despite listed threat actor mentions.

How an attack unfolds

An attacker triggers DMCUB work timeout conditions to force diagnostic collection, resulting in unauthorized register access and security violation; listed espionage and financially motivated actors plus Linux kernel resource vulnerabilities provide context for potential local or kernel-context abuse.

How to fix it

Update the Linux kernel to commit eba4b2a38ccdf074a053834509545703d6df1d57 or later; for github.com/hashicorp/vault update to 1.3.4. Apply the fix that removes the DCN35 register read from diagnostic collection.

How to confirm the fix worked

Confirm kernel version contains commit eba4b2a38ccdf074a053834509545703d6df1d57, verify absence of the removed register read in DCN35 diagnostic code, and test that DMCUB timeouts no longer trigger security violations or block Z8 entry.

Typical attack path

1. Identify systems running vulnerable Linux kernel with AMD DCN35 display hardware
2. Trigger DMCUB workload timeout to invoke diagnostic path
3. Observe security violation and blocked Z8 entry
4. Leverage resulting instability or diagnostic output for further access

How to detect it

Review kernel logs for DMCUB timeout messages, security violation entries, and Z8 entry failures on AMD display hardware; correlate with process activity involving display driver initialization.

What your security team should do

• Prioritize kernel updates on all AMD DCN35 systems within standard patching windows given low EPSS
• Monitor for downstream dependents affected via org/pub/scm/linux/kernel/git/stable/linux.git
• Include the fix in next maintenance cycle; no ransomware or KEV-driven immediate action required