CVE-2024-49969

What it actually does

Out-of-bounds write in cm3_helper_translate_curve_to_hw_format when index i exceeds TRANSFER_FUNC_POINTS, allowing buffer overflow of output_tf->tf_pts.red/green/blue arrays.

Why it matters to the business

Potential kernel crashes or memory corruption on AMD GPU systems during color management operations, leading to display instability, denial of service, or elevated privileges in graphics workloads; high prevalence in Linux distributions amplifies operational risk.

How an attack unfolds

An attacker crafts or triggers display color transformation operations that cause the index variable to exceed the transfer function point limit inside the DCN30 color module; the missing bounds check allows writes past the end of the tf_pts buffers, potentially enabling memory corruption. Threat actors in 2024 zero-day campaigns and Linux kernel out-of-bounds write patterns have targeted similar kernel flaws.

How to fix it

Upgrade Linux kernel to commit 7ab69af56a23859b647dee69fa1052c689343621 or later; for Rocky Linux 8 apply rust 1.49.0-1.module+el8.4.0+416+259a129a and rust-toolset equivalent packages. Reboot after kernel update.

How to confirm the fix worked

Verify kernel version contains the listed commit; recompile or run the function with boundary test cases to confirm the added bounds check returns false on overflow; monitor for absence of the static analysis warnings on lines 180-182.

Typical attack path

1. Obtain local or remote access to a system with vulnerable AMD display driver
2. Trigger color curve translation via graphics API or display configuration that exercises cm3_helper_translate_curve_to_hw_format
3. Supply input causing index i to exceed TRANSFER_FUNC_POINTS
4. Write beyond tf_pts buffers to corrupt adjacent kernel memory
5. Escalate to crash or code execution

How to detect it

Review kernel logs for buffer overflow warnings referencing dcn30_cm_common.c or cm3_helper_translate_curve_to_hw_format; inspect crash dumps for out-of-bounds writes to tf_pts arrays; correlate with display subsystem activity from threat actors exploiting Linux kernel out-of-bounds write issues.

What your security team should do

• Immediately apply the referenced kernel and package updates on all AMD GPU hosts
• Prioritize systems listed in CISA KEV guidance if status changes
• Harden graphics workloads by restricting untrusted display configuration access
• Monitor EPSS trend (stable at 0.0027) and threat actor reports for escalation