CVE-2024-49905

What it actually does

Missing null check on 'afb' variable allows null pointer dereference in amdgpu_dm_plane_handle_cursor_update when handling cursor updates on AMD display hardware.

Why it matters to the business

Unpatched systems using affected AMD GPUs may experience kernel crashes or instability during graphics operations, increasing downtime risk for workloads on Rocky Linux 8 and similar distributions with high package prevalence.

How an attack unfolds

An attacker with local access crafts conditions to invoke the cursor update path where 'afb' is null, triggering the dereference; listed threat actors in zero-day campaigns and kernel memory issues provide context for potential targeted attempts though public exploits remain absent.

How to fix it

Apply kernel updates containing commit bd0e24e5e608ccb9fdda300bb974496d6d8cf57d or upgrade affected Rocky Linux 8 packages to listed fixed versions such as runc 1.0.0-65.rc10, python-podman-api 1.2.0-0.2.gitd0a45fe, container-selinux 2.124.0-1.gitf958d0c, and equivalent fixes for udica, slirp4netns, criu, toolbox, and buildah.

How to confirm the fix worked

Verify presence of the null check in amdgpu_dm_plane.c around line 1298, confirm package versions match fixed releases, and test graphics workloads on AMD hardware for stability post-update.

Typical attack path

1. Obtain local access on a vulnerable Linux system with AMD display driver loaded
2. Trigger cursor plane update operations via graphics API or display events
3. Supply input causing 'afb' to remain null at the dereference site
4. Cause kernel panic or memory corruption leading to denial of service

How to detect it

Review kernel logs for null pointer dereference oops in amdgpu_dm_plane_handle_cursor_update; correlate with graphics or display subsystem activity on AMD hardware; no widespread exploitation indicators reported given false KEV status.

What your security team should do

• Prioritize patching kernel and listed Rocky Linux packages within standard maintenance windows given low EPSS but kernel memory corruption family
• Monitor for any EPSS increases or new threat actor activity referencing Linux kernel vulnerabilities
• Audit AMD GPU systems for exposure and schedule validation after applying fixes