CVE-2024-53108

What it actually does

Out-of-bounds read in amdgpu_dm_update_freesync_caps when the VSDB parser extracts IEEE ID for replay without validating against the actual EDID length or amd_vsdb_block size, allowing reads past the allocated slab buffer.

Why it matters to the business

Local users on systems with AMD GPUs can trigger kernel crashes or limited memory disclosure, leading to denial of service and potential information leaks on Linux workstations or servers using recent display drivers.

How an attack unfolds

An attacker with local access supplies a crafted EDID containing a replay VSDB block whose length field causes the ID extraction to occur outside the reported EDID size; the kernel driver performs the read without bounds checking, hitting KASAN-detected slab OOB.

How to fix it

Update the Linux kernel to a version containing commit 0a326fbc8f72a320051f27328d4d4e7abdfe68d7 or later; rebuild and reboot with the patched amdgpu module. Disable replay features if immediate patching is impossible.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or later; re-test EDID parsing paths under KASAN; confirm no slab-out-of-bounds reports appear when attaching displays advertising replay VSDB.

Typical attack path

1. Obtain local shell on target Linux system with AMDGPU driver loaded
2. Craft or present a malicious EDID via display hotplug or userspace tool that advertises a replay VSDB
3. Trigger amdgpu_dm_update_freesync_caps during EDID parsing
4. Read or crash occurs due to OOB access

How to detect it

Search kernel logs for KASAN reports containing amdgpu_dm_update_freesync_caps and slab-out-of-bounds; inspect systemd-udevd or display hotplug events that precede the crash; review EDID blobs presented to the driver.

• BUG: KASAN: slab-out-of-bounds in amdgpu_dm_update_freesync_caps
• amdgpu_dm_update_freesync_caps+0xefa
• Read of size 1 at addr ffff888
• ffff8881647fdb00: fc fc fc fc fc fc fc fc

What your security team should do

• Apply the referenced kernel patch or distribution update within standard change windows given low EPSS
• Monitor for amdgpu driver crashes referencing freesync_caps
• Restrict unprivileged local access where possible until patched