CVE-2024-56775

What it actually does

The vulnerability stems from plane state backup and restore operations in the AMD display driver that fail to preserve refcount values, allowing the refcount to become inconsistent between backup and restore; this produces memory leaks when refcount should decrease or double-free/invalid access when refcount should increase, resulting in use-after-free conditions.

Why it matters to the business

Unpatched systems risk graphics driver instability, kernel memory corruption, or crashes that can interrupt workloads on affected Linux distributions and downstream packages such as older Chromium builds; low EPSS and absence from KEV indicate limited immediate operational urgency but still require prompt patching to avoid potential privilege escalation or denial of service.

How an attack unfolds

An attacker with local access crafts graphics operations that trigger the AMD display driver's plane state backup/restore path, manipulates refcount timing between the two operations, and then reuses the freed or corrupted plane object to achieve memory corruption or code execution within the kernel.

How to fix it

Upgrade affected packages to the listed fixed versions; for chromium-browser on Ubuntu 14.04 LTS apply 53.0.2785.143-0ubuntu0.14.04.1.1142 or later and rebuild or reinstall any dependent kernel modules if custom kernels are in use.

How to confirm the fix worked

Confirm package versions match or exceed the fixed releases, run kernel regression tests exercising AMD display plane state backup/restore paths, and verify refcount handling logs show no anomalies after applying the update.

Typical attack path

1. Obtain local user access on a vulnerable system
2. Trigger display plane state backup via targeted graphics or display API calls
3. Force refcount change between backup and restore
4. Trigger restore to create use-after-free condition
5. Reuse dangling pointer for memory corruption or escalation

How to detect it

Review kernel logs for AMD display driver warnings around plane refcount or state restore failures; examine crash dumps for use-after-free signatures in drm/amd/display code paths; correlate with process activity involving graphics APIs.

What your security team should do

• Prioritize patching chromium-browser and any dependent kernel packages within standard maintenance windows given low EPSS
• Monitor upstream Linux kernel stable branches for additional backports
• Audit graphics driver usage in high-value systems for exposure to plane state operations