CVE-2024-46722 – This CVE-2024-46722 is an out-of-bounds read vu... (How to Fix)

Q: What is the severity of CVE-2024-46722?

CVE-2024-46722 has a CVSS score of 7.1 (HIGH). This CVE-2024-46722 is an out-of-bounds read vulnerability in the AMD GPU driver within the Linux kernel. It could allow attackers to read kernel memory beyond allocated boundaries, potentially leaking sensitive information. Systems using affected AMD GPU hardware with vulnerable kernel versions are impacted.

📋 TL;DR

This CVE-2024-46722 is an out-of-bounds read vulnerability in the AMD GPU driver within the Linux kernel. It could allow attackers to read kernel memory beyond allocated boundaries, potentially leaking sensitive information. Systems using affected AMD GPU hardware with vulnerable kernel versions are impacted.

💻 Affected Systems

Products:

Linux kernel with AMD GPU driver (drm/amdgpu)

Versions: Specific kernel versions containing the vulnerable code (check git commits for exact ranges)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires AMD GPU hardware and the amdgpu driver to be loaded/used. Systems without AMD GPUs or with the driver disabled are not affected.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory disclosure leading to information leakage, potential privilege escalation if combined with other vulnerabilities, or system instability/crashes.

🟠

Likely Case

Information disclosure of kernel memory contents, potentially exposing sensitive data or causing system instability.

🟢

If Mitigated

Limited impact due to memory access restrictions, possibly just warning messages or minor system instability.

🌐 Internet-Facing: LOW - This requires local access or ability to execute code on the system; not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local attackers or malicious users could potentially exploit this to gain information about kernel memory.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to trigger the vulnerable code path in the AMD GPU driver. No public exploits known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the fixes from the provided git commits

Vendor Advisory: https://git.kernel.org/stable/c/2097edede72ec5bb3869cf0205337d392fb2a553

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable AMD GPU driver

linux

Prevent loading of the vulnerable amdgpu kernel module

echo 'blacklist amdgpu' >> /etc/modprobe.d/blacklist.conf
update-initramfs -u
reboot

🧯 If You Can't Patch

Restrict local user access to systems with AMD GPUs
Monitor system logs for unusual GPU driver activity or crashes

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if amdgpu module is loaded: 'uname -r' and 'lsmod | grep amdgpu'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and contains the fix commits, then check system stability with AMD GPU usage

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages related to amdgpu driver
GPU-related crash reports in system logs
dmesg warnings about out-of-bounds access

Network Indicators:

None - this is a local vulnerability

SIEM Query:

source="kernel" AND ("amdgpu" OR "GPU") AND ("oops" OR "panic" OR "BUG")

📊 Metadata

CVE ID: CVE-2024-46722

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-125

Published: September 18, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-46722, you might also want to check these: