CVE-2024-50049

What it actually does

Null pointer dereference in the AMD display driver when reusing the 'se' pointer without a second null check after an earlier conditional check in the same function, classified as memory corruption.

Why it matters to the business

System instability, kernel panics, or crashes on Linux hosts using AMD graphics hardware, disrupting workloads, virtualization stacks, and guest tools on Rocky Linux 8 deployments with moderate downstream package prevalence.

How an attack unfolds

A local attacker triggers AMD display code paths where 'se' becomes null, dereferences the pointer to induce a crash or memory corruption; listed threat actor campaigns involving Linux kernel flaws could chain this into denial of service or limited privilege escalation.

How to fix it

Upgrade to fixed package versions including libvirt 0:6.0.0-37.1.module+el8.5.0+732+d204e9f7, qemu-kvm 5:4.2.0-59.module+el8.5.0+670+c4aa478c, libguestfs 1:1.40.2-28.module+el8.5.0+670+c4aa478c and kernel commit f4149eec960110ffd5bcb161075dd9f1d7773075; apply all Rocky Linux 8 module updates containing the null-check fix.

How to confirm the fix worked

Confirm installed package versions match or exceed the listed fixed releases, inspect kernel source or dmesg for the added null check around 'se', and exercise AMD display paths under test workloads to verify stability.

Typical attack path

1. Obtain local access on an affected Linux system with AMD GPU
2. Trigger display initialization or mode-setting operations exercising the vulnerable drm/amd/display function
3. Force the code path where 'se' is null to dereference it
4. Leverage resulting corruption or panic for denial of service or further exploitation

How to detect it

Scan kernel logs and dmesg for entries referencing drm/amd/display and null pointer issues; correlate with system crashes or reboots on AMD hardware; review audit trails for local processes triggering display code around the publication timeframe.

• drm/amd/display.*se
• FORWARD_NULL.*amd display
• null pointer dereference.*display

What your security team should do

• Apply kernel and dependent package updates immediately on AMD-equipped Rocky Linux 8 systems
• Review and test virtualization and display-related packages for version compliance
• Monitor kernel logs and system stability metrics for display driver anomalies until patches are deployed