CVE-2024-49894

What it actually does

Missing bounds check in cm_helper_translate_curve_to_degamma_hw_format allows index 'i' to exceed TRANSFER_FUNC_POINTS, resulting in out-of-bounds write to output_tf->tf_pts.red/green/blue arrays.

Why it matters to the business

Local attackers on affected AMD GPU systems can trigger kernel memory corruption, enabling privilege escalation, system crashes, or denial of service that disrupts graphics workloads and containerized environments.

How an attack unfolds

An attacker with local access supplies crafted transfer function data to the AMD display color management path, causing the unchecked index to overflow the tf_pts buffers during hardware format translation.

How to fix it

Apply the Linux kernel fix at commit b3dfa878257a7e98830b3009ca5831a01d8f85fc. For Rocky Linux 8 deployments update to runc-1.0.0-65.rc10, python-podman-api-1.2.0-0.2, udica-0.2.1-2, container-selinux-2.124.0-1, slirp4netns-0.4.2-3, criu-3.12-9, and toolbox-0.0.7-1 module packages.

How to confirm the fix worked

Confirm presence of the bounds check returning false on out-of-range index; verify kernel build includes the referenced commit and test degamma curve translation with maximum index values.

Typical attack path

1. Obtain local user access on a system with vulnerable AMD display driver
2. Invoke color management APIs that call cm_helper_translate_curve_to_degamma_hw_format
3. Provide out-of-bounds index value exceeding TRANSFER_FUNC_POINTS
4. Trigger buffer overflow write into tf_pts structures

How to detect it

Review kernel logs for oops/panic entries referencing dcn10_cm_common.c or buffer overflow warnings around tf_pts arrays; correlate with local user sessions invoking display color APIs.

What your security team should do

• Prioritize kernel and container runtime updates on all AMD GPU hosts
• Restrict unprivileged local access to graphics subsystems until patched
• Audit logs for display driver faults after deployment