CVE-2024-50016

What it actually does

An integer overflow occurs in the AMD display driver when a uint8_t sampling_rate variable receives an unsigned int value and a 2-bit LINK_QUAL_PATTERN_SET field is assigned values exceeding 4, allowing out-of-bounds behavior in link_dp_cts.

Why it matters to the business

Systems using AMD GPUs on affected Linux kernels may experience display instability, driver crashes, or undefined behavior that disrupts graphics workloads until the kernel is updated.

How an attack unfolds

An attacker with local access or the ability to influence display link training triggers the vulnerable code path in the display driver, supplying values that overflow the narrow types and produce invalid pattern or rate settings.

How to fix it

Upgrade the Linux kernel to version 6.11.4-1 or newer on Debian 13 systems; rebuild and reboot with the patched kernel image.

How to confirm the fix worked

Confirm the running kernel version is at least 6.11.4-1 and verify the source contains the uint32_t change for sampling_rate and the bounds check for LINK_QUAL_PATTERN_SET.

Typical attack path

1. Obtain local execution or display configuration control on a vulnerable kernel
2. Force AMD display link training or CTS test execution
3. Supply oversized sampling rate or pattern values to the link_dp_cts function
4. Trigger integer overflow leading to memory corruption or invalid hardware programming

How to detect it

Review system logs for AMD display driver faults during link training or CTS operations and correlate with kernel version prior to 6.11.4-1.

What your security team should do

• Apply the 6.11.4-1 kernel update across all AMD GPU systems within the next maintenance window
• Monitor for display driver crashes or abnormal link training logs until patches are deployed
• Restrict unprivileged local access on multi-user systems until remediation is complete