CVE-2024-49892

What it actually does

The flaw allows divide-by-zero conditions when get_bytes_per_element returns zero for bytes_per_element_y or bytes_per_element_c variables used as denominators in AMD display driver calculations.

Why it matters to the business

Systems may experience crashes or denial of service during graphics operations, causing downtime and requiring restarts on affected Linux deployments; the package appears in many dependency chains increasing exposure surface.

How an attack unfolds

A local attacker triggers the uninitialized resource path in the display code by performing operations that invoke get_bytes_per_element without ensuring a non-zero return, leading to kernel-level divide-by-zero faults; listed threat actors have shown interest in similar Linux kernel issues.

How to fix it

Upgrade cocoapods-downloader to version 1.6.2; apply the upstream Linux kernel patch that ensures get_bytes_per_element never returns zero.

How to confirm the fix worked

Confirm the package version is at least 1.6.2 and verify kernel builds include the initialization fix for bytes_per_element variables; run static analysis tools to ensure no remaining zero-denominator paths.

Typical attack path

1. Obtain local user access on a Linux system with AMD display hardware
2. Invoke display or graphics operations that call the vulnerable initialization path
3. Force get_bytes_per_element to return zero for denominator variables
4. Trigger divide-by-zero exception resulting in system instability

How to detect it

Inspect system logs for kernel divide-by-zero faults in drm/amd/display paths and review process activity around display initialization; correlate with any listed threat actor TTPs for Linux kernel resource issues.

What your security team should do

• Prioritize patching cocoapods-downloader to 1.6.2 across all environments due to high downstream prevalence
• Monitor for local privilege or graphics-related crash reports on AMD Linux systems
• Review dependency trees for cocoapods-downloader usage and schedule upgrades before any KEV listing