CVE-2024-53060

What it actually does

Null pointer dereference in the amdgpu DRM driver when acpi_evaluate_object returns AE_NOT_FOUND, causing buffer.pointer to be dereferenced while NULL.

Why it matters to the business

Potential system crashes or denial of service on AMD GPU systems running affected kernel versions, with low but non-zero risk of broader impact given the kernel memory corruption family and listed threat actor interest in similar Linux kernel issues.

How an attack unfolds

An attacker with local access or ability to trigger ACPI paths in the amdgpu driver could attempt to induce the AE_NOT_FOUND condition to dereference a null pointer, potentially leading to a kernel panic; listed threat actors have targeted similar Linux kernel resource and bounds issues in espionage and financially motivated campaigns.

How to fix it

Update to fixed kernel versions containing the cherry-picked commit; for listed qemu on Ubuntu 14.04 LTS apply 2.0.0+dfsg-2ubuntu1.22 or later packages.

How to confirm the fix worked

Confirm kernel source includes the AE_NOT_FOUND status check before acpi buffer dereference; test ACPI paths on AMD systems without ATIF support.

Typical attack path

1. Identify target system with vulnerable amdgpu driver and AMD hardware
2. Trigger ACPI evaluation paths that return AE_NOT_FOUND status
3. Force dereference of null buffer.pointer resulting in kernel fault

How to detect it

Review kernel logs for null pointer dereference oops in amdgpu or drm paths; correlate with ACPI evaluation failures on affected hardware.

What your security team should do

• Prioritize kernel updates on all AMD GPU hosts given the memory corruption classification
• Monitor EPSS and KEV status for any future rise in exploitation likelihood
• Audit systems for the listed qemu package versions and apply the exact fixed Ubuntu package