CVE-2024-49895

What it actually does

Out-of-bounds write via unchecked index 'i' exceeding TRANSFER_FUNC_POINTS in cm3_helper_translate_curve_to_degamma_hw_format, allowing buffer overflow of output_tf->tf_pts.red/green/blue arrays.

Why it matters to the business

Potential kernel crash or memory corruption on AMD DCN30 GPUs during color curve handling, leading to display instability or denial of service on affected Linux systems; low exploit likelihood limits widespread operational disruption.

How an attack unfolds

An attacker supplies a crafted transfer function with an out-of-bounds index to the degamma hardware format translation routine, triggering the buffer overflow during graphics color management operations on vulnerable AMD display hardware.

How to fix it

Apply the upstream fix in commit ad89f83343a501890cf082c8a584e96b59fe4015 or later stable kernel versions; rebuild and deploy updated kernel packages containing the bounds check that returns false on overflow.

How to confirm the fix worked

Confirm kernel source contains the added bounds check before array access in dcn30_cm_common.c; test with smatch or equivalent static analysis and verify no buffer overflow warnings for the three tf_pts fields.

Typical attack path

1. Identify system with vulnerable AMD DCN30 display driver
2. Trigger graphics or display configuration code path invoking cm3_helper_translate_curve_to_degamma_hw_format
3. Supply malicious transfer function data causing index to exceed bounds
4. Achieve out-of-bounds write into tf_pts arrays

How to detect it

Review kernel logs for buffer overflow or out-of-bounds access messages referencing dcn30_cm_common.c or cm3_helper_translate_curve_to_degamma_hw_format; correlate with recent graphics driver activity or display configuration changes.

What your security team should do

• Prioritize kernel updates on systems using AMD DCN30 GPUs
• Monitor for graphics-related kernel oops or crashes as a proxy indicator
• Restrict untrusted display or color profile inputs where feasible until patched