CVE-2024-49909

What it actually does

Null pointer dereference in dcn32_set_output_transfer_func due to missing validation of the set_output_gamma function pointer before dereference, resulting in potential memory corruption.

Why it matters to the business

System instability or crashes during graphics display operations on affected Linux kernels, with elevated urgency due to listed zero-day exploitation campaigns by espionage and financially motivated actors and high ecosystem prevalence in Linux distributions.

How an attack unfolds

An attacker triggers the vulnerable code path in the AMD display driver by manipulating display output settings so that set_output_gamma remains null, causing a dereference that leads to a crash; observed in 2024 zero-day campaigns by espionage and financially motivated actors alongside other Linux kernel resource and bounds issues.

How to fix it

Apply kernel patches that add the null check for set_output_gamma before dereference; for listed actionpack packages upgrade to fixed versions 4.0.2 or 3.2.16 as applicable.

How to confirm the fix worked

Confirm presence of the null check in dcn32_set_output_transfer_func source after update and verify no crash occurs under display output operations that previously triggered the condition.

Typical attack path

1. Identify system with vulnerable AMD display driver in Linux kernel
2. Craft display configuration or graphics operation to reach dcn32_set_output_transfer_func with null set_output_gamma
3. Trigger null dereference to induce kernel panic or memory corruption
4. Leverage resulting instability for denial of service or further exploitation

How to detect it

Review kernel logs for null pointer dereference oops messages involving dcn32_set_output_transfer_func or amd display driver; correlate with recent graphics configuration changes and check for indicators from listed Linux kernel vulnerabilities.

• dcn32_set_output_transfer_func
• set_output_gamma
• null pointer dereference in amd/display

What your security team should do

• Prioritize kernel updates on systems with AMD display hardware given 721 days since publication and active threat actor campaigns
• Monitor for related Linux kernel out-of-bounds and uninitialized resource issues listed in threat actors
• Test display functionality post-update to ensure stability