CVE-2024-49991

What it actually does

The flaw in amdkfd_free_gtt_mem passes a local pointer instead of a reference to amdgpu_bo_unref, leaving the original pointer non-NULL after the backing buffer is freed and enabling subsequent use-after-free access in the AMD KFD driver.

Why it matters to the business

Systems running vulnerable Linux kernels on AMD GPUs face risk of local privilege escalation or kernel crashes, which can interrupt workloads, expose kernel memory, or allow attackers to compromise hosts in shared or multi-tenant environments.

How an attack unfolds

A local attacker triggers repeated GPU memory allocation and free sequences through the KFD ioctl interface; because the dangling pointer is not cleared, a subsequent access re-uses the freed buffer, enabling arbitrary read/write or control-flow hijacking within the kernel.

How to fix it

Apply the upstream fix e7831613cbbcd9058d3658fbcdc5d5884ceb2e0c or later; on Rocky Linux 8 update nodejs to 1:12.22.5-1.module+el8.4.0+647+e905fa21, nodejs-nodemon to 0:2.0.3-1.module+el8.6.0+982+9fdca2d4, and nodejs-packaging to 0:17-3.module+el8.3.0+101+f84c7154; reboot after kernel package installation.

How to confirm the fix worked

Confirm the running kernel contains commit e7831613cbbcd9058d3658fbcdc5d5884ceb2e0c; inspect amdkfd_free_gtt_mem to verify a pointer reference is passed to amdgpu_bo_unref; re-run KFD memory stress tests to ensure no dangling-pointer dereferences occur.

Typical attack path

1. Obtain a local shell on a system exposing the vulnerable amdkfd driver
2. Issue KFD memory-management ioctls to allocate and free GTT buffers
3. Race or reuse the freed object via the uncleared pointer
4. Escalate to kernel code execution or trigger denial of service

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for amdkfd or amdgpu use-after-free warnings; monitor for repeated KFD ioctl sequences from unprivileged processes; examine crash dumps for dangling GTT buffer references.

• amdkfd_free_gtt_mem
• amdgpu_bo_unref
• use-after-free.*amdkfd

What your security team should do

• Patch kernel packages on all AMD GPU hosts within the next maintenance window
• Limit untrusted local accounts on GPU-enabled systems until patches are deployed
• Add kernel version checks to existing vulnerability scanning workflows