CVE-2024-49893

What it actually does

The flaw is a missing null check on the result of dc_state_get_stream_status in the AMD display driver; when the function returns null, subsequent dereference of stream_status triggers a NULL_RETURNS condition that can crash the kernel.

Why it matters to the business

Systems using AMD graphics on Rocky Linux 8 kernels can experience unexpected crashes or reboots during display operations, causing unplanned downtime for servers, workstations, and virtualized environments that rely on those systems.

How an attack unfolds

An attacker with local access or the ability to influence display state configuration triggers a code path where dc_state_get_stream_status returns null; without the added check the kernel then dereferences the null pointer, resulting in a panic or denial of service. Named campaigns involving Linux kernel out-of-bounds and use-of-uninitialized-resource issues illustrate the broader interest threat actors have shown in kernel display and resource-handling flaws.

How to fix it

Apply the kernel fix that adds the null check before stream_status is used. Where package-level updates are distributed, upgrade the listed Rocky Linux 8 components to the exact fixed versions (for example apache-commons-collections to 0:3.2.2-10.module+el8.3.0+53+ea062990, jackson-databind to 0:2.10.0-1.module+el8.3.0+53+ea062990, and all other listed packages to their corresponding fixed module streams).

How to confirm the fix worked

Confirm the running kernel contains the upstream commit that guards the return value of dc_state_get_stream_status; verify package versions match the supplied fixed module streams and test display reconfiguration workloads to ensure no null dereference occurs.

Typical attack path

1. Obtain local or container-level access to a vulnerable Rocky Linux 8 system with AMD display hardware
2. Craft or trigger display-state changes that cause dc_state_get_stream_status to return null
3. Force the kernel to dereference the unchecked stream_status pointer
4. Induce kernel panic or system instability

How to detect it

Search kernel logs (dmesg, /var/log/messages, journalctl) for NULL pointer dereference oops messages originating from the amdgpu or drm/amd/display code paths; correlate with recent display configuration changes or user sessions that exercise AMD hardware.

What your security team should do

• Prioritize kernel and listed package updates on all AMD-based Rocky Linux 8 hosts within the next maintenance window
• Monitor EPSS trend (stable at ~0.002) and re-evaluate if new exploit code appears
• Add kernel oops and panic logging to the SOC SIEM for rapid detection of related crashes
• Review any downstream images or containers that embed the affected kernel or packages