CVE-2024-50189

What it actually does

Improper cleanup of coherent DMA memory allocation in the amd_sfh HID driver probe error path leaves resources dangling, resulting in memory errors, page faults, and btrfs filesystem corruption.

Why it matters to the business

Systems may experience crashes, read-only filesystems, and data corruption leading to operational downtime and potential loss of critical data on affected Linux deployments.

How an attack unfolds

An attacker with local access triggers error paths during device probe in the amd_sfh driver to exploit incomplete resource release, causing use of freed memory that manifests as page faults or btrfs corruption; listed threat actors in Linux kernel campaigns could leverage similar patterns for privilege escalation or denial of service.

How to fix it

Update the Linux kernel to commit 8c6ad37e5882073cab84901a31da9cb22f316276 or later stable versions containing the device-managed dmam_alloc_coherent() change; apply equivalent fixes for any downstream distributions.

How to confirm the fix worked

Verify kernel source or running version includes the referenced commit; inspect probe error paths for dmam_alloc_coherent usage and confirm absence of manual cleanup errors via static analysis or runtime memory debugging tools.

Typical attack path

1. Obtain local access on target Linux system
2. Trigger amd_sfh HID device probe failure conditions
3. Exploit dangling coherent memory allocations
4. Induce page faults or btrfs read-only state and corruption

How to detect it

Review kernel logs for page fault and btrfs corruption messages around HID amd_sfh probe events; examine system call traces and memory allocation failures in dmesg or journalctl for signs of prior exploitation attempts by listed threat actors.

What your security team should do

• Prioritize kernel upgrades on systems using amd_sfh HID drivers
• Monitor for btrfs filesystem errors and page faults in production workloads
• Apply patches within standard maintenance windows given low EPSS but memory corruption family classification