CVE-2024-49972

What it actually does

In the Linux kernel AMD display driver, failure during DC state DML memory allocation leaves the structure uninitialized and not set to NULL, resulting in memory corruption.

Why it matters to the business

Systems running affected Rocky Linux 8 container tooling and kernel builds face elevated risk of crashes, instability, or exploitation in AMD graphics environments; widespread package prevalence increases exposure across container hosts.

How an attack unfolds

An attacker triggers DC state creation under memory pressure to cause DML allocation failure; the resulting uninitialized non-NULL structure is then used, enabling memory corruption that could be chained by espionage or financially motivated actors exploiting similar Linux kernel resource issues.

How to fix it

Upgrade to the listed fixed versions for each package on Rocky Linux 8 (e.g., podman to 0:1.6.4-26.module+el8.4.0+559+c02fa3b2, kernel to commit 80345daa5746184195f2d383a2f1bad058f0f94c) and rebuild or restart affected container workloads.

How to confirm the fix worked

Confirm package versions match the provided fixed releases, verify kernel commit presence, and test DC state creation under simulated allocation failure conditions.

Typical attack path

1. Identify target systems running vulnerable Linux kernel with AMD display and affected container packages
2. Induce memory pressure to force DML allocation failure during DC state creation
3. Trigger use of the uninitialized structure to achieve memory corruption
4. Leverage corruption for privilege escalation or denial of service

How to detect it

Review kernel logs and container runtime logs for allocation failure messages during display initialization; correlate with threat actor patterns seen in other Linux kernel resource vulnerabilities.

What your security team should do

• Prioritize kernel and container package upgrades on all Rocky Linux 8 hosts with AMD graphics
• Monitor EPSS trend and threat actor activity for similar Linux kernel memory issues
• Apply fixes before any internal deadlines derived from published date
• Harden container hosts to reduce memory pressure that could trigger the flaw