CVE-2024-49971

What it actually does

Out-of-bounds write due to accessing index 2 of a 2-element dummy_boolean array in dml2_core_shared_mode_support and dml_core_mode_support, causing an OVERRUN on assignment to hw_debug5.

Why it matters to the business

Kernel memory corruption risk in AMD display subsystem on Linux systems may lead to crashes, instability, or potential privilege escalation; widespread impact across distributions requires prioritized patching.

How an attack unfolds

An attacker triggers display mode support calculations in the AMD DRM driver to reach the erroneous array access, resulting in memory corruption that could be leveraged for further attacks.

How to fix it

Upgrade to Linux kernel 6.11.3 or apply the git fix commit e9e48b7bb9cf3b78f0305ef0144aaf61da0a83d8; for Rocky Linux 8 nginx package use 1:1.16.1-2.module+el8.4.0+543+efbf198b.1 or newer equivalent.

How to confirm the fix worked

Confirm kernel version >= 6.11.3; verify presence of the array size increase to 3 in drm/amd/display code and absence of Coverity OVERRUN reports.

Typical attack path

1. Gain local execution context on affected Linux kernel
2. Invoke AMD display driver mode support functions
3. Trigger access to dummy_boolean[2] causing overrun
4. Exploit resulting memory corruption

How to detect it

Search kernel logs and crash dumps for AMD display driver faults around dml mode support calls; check for unexpected memory access violations in drm/amd/display.

What your security team should do

• Apply kernel updates to 6.11.3 or later immediately
• Prioritize systems with AMD GPUs running vulnerable kernels
• Monitor for post-patch stability in display subsystem
• Review logs for prior display-related crashes