CVE-2024-47683

What it actually does

NULL pointer dereference in drm_dp_atomic_find_time_slots during MST + DSC atomic state computation in the AMD display driver, triggered when recomputing DSC parameters without an active stream on the link.

Why it matters to the business

Kernel panic and system crash on affected Linux systems using AMD GPUs with multi-stream transport displays and display stream compression, leading to downtime and loss of availability; high ecosystem prevalence increases exposure for many distributions and downstream packages.

How an attack unfolds

An attacker with local access crafts a specific display configuration request involving MST and DSC; the drm_atomic_check path calls compute_mst_dsc_configs_for_link without verifying an active stream, dereferencing a null pointer and causing an oops. No named threat actors have been observed exploiting this specific issue despite generic mentions of kernel memory corruption campaigns.

How to fix it

Update the Linux kernel to a version containing commit 282f0a482ee61d5e863512f3c4fcec90216c20d9 or later; for the global-modules-path npm package upgrade to 3.0.0 or newer. Reboot after patching and verify no mode changes occur without an active stream.

How to confirm the fix worked

Confirm kernel contains the listed commit or newer; reproduce MST+DSC atomic check paths in a test environment and verify absence of the oops; inspect dmesg for the original call trace signature after applying the fix.

Typical attack path

1. Obtain local code execution on target system
2. Trigger DRM atomic ioctl with MST + DSC display state that lacks an active stream
3. Force amdgpu_dm_atomic_check to invoke compute_mst_dsc_configs_for_link
4. Reach drm_dp_atomic_find_time_slots with null stream pointer
5. Cause kernel NULL dereference and panic

How to detect it

Search kernel logs and dmesg for the call trace containing drm_dp_atomic_find_time_slots, compute_mst_dsc_configs_for_link, and amdgpu_dm_atomic_check; look for BUG: kernel NULL pointer dereference at address 0000000000000008 combined with the listed RIP offset.

• drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper]
• compute_mst_dsc_configs_for_link+0x2ff/0xa40 [amdgpu]
• BUG: kernel NULL pointer dereference, address: 0000000000000008
• RIP: 0010:drm_dp_atomic_find_time_slots+0x5e/0x260

What your security team should do

• Apply the referenced kernel commit immediately on all AMD GPU systems
• Prioritize patching for multi-monitor and DSC-enabled workstations
• Monitor kernel logs for the drm_dp_atomic_find_time_slots oops pattern
• Test display reconfiguration workloads after upgrade