CVE-2024-46811 – This CVE describes a buffer overrun vulnerabili... (How to Fix)

Q: What is the severity of CVE-2024-46811?

CVE-2024-46811 has a CVSS score of 7.8 (HIGH). This CVE describes a buffer overrun vulnerability in the AMD display driver within the Linux kernel. An attacker could potentially write beyond allocated memory bounds, which may lead to system crashes or arbitrary code execution with kernel privileges. This affects Linux systems with AMD graphics hardware using the affected driver.

📋 TL;DR

This CVE describes a buffer overrun vulnerability in the AMD display driver within the Linux kernel. An attacker could potentially write beyond allocated memory bounds, which may lead to system crashes or arbitrary code execution with kernel privileges. This affects Linux systems with AMD graphics hardware using the affected driver.

💻 Affected Systems

Products:

Linux kernel with AMD display driver (drm/amd/display)

Versions: Linux kernel versions containing the vulnerable code before the fix commits

Operating Systems: Linux distributions with affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires AMD graphics hardware and the affected display driver to be loaded. Systems without AMD graphics or with the driver disabled are not vulnerable.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to denial of service, or potential arbitrary code execution with kernel privileges resulting in complete system compromise.

🟠

Likely Case

System crash or instability when the vulnerable function is triggered, requiring reboot to restore functionality.

🟢

If Mitigated

System crash with no privilege escalation if kernel protections like KASLR and SMEP are properly configured.

🌐 Internet-Facing: LOW - This vulnerability requires local access or ability to trigger the specific display driver function.

🏢 Internal Only: MEDIUM - Local users or processes could potentially trigger this vulnerability to cause denial of service.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires triggering the specific fpu_update_bw_bounding_box function with controlled parameters. This is a local vulnerability requiring access to the system.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 188fd1616ec43033cedbe343b6579e9921e2d898, 4003bac784380fed1f94f197350567eaa73a409d, or aba188d6f4ebaf52acf13f204db2bd2c22072504

Vendor Advisory: https://git.kernel.org/stable/c/188fd1616ec43033cedbe343b6579e9921e2d898

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel package. 3. Reboot system to load patched kernel.

🔧 Temporary Workarounds

Disable AMD display driver

linux

Prevent loading of the vulnerable AMD display driver module

echo 'blacklist amdgpu' >> /etc/modprobe.d/blacklist.conf
update-initramfs -u

🧯 If You Can't Patch

Restrict local user access to systems with AMD graphics hardware
Implement strict process isolation and privilege separation to limit impact of potential crashes

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if AMD display driver is loaded: lsmod | grep amdgpu && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and AMD driver loads without issues

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
AMD driver crash messages in dmesg
System crash/reboot events

Network Indicators:

None - this is a local vulnerability

SIEM Query:

Search for: 'kernel panic', 'amdgpu crash', 'system crash' in system logs

📊 Metadata

CVE ID: CVE-2024-46811

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-129

Published: September 27, 2024

Last Updated: October 7, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-46811, you might also want to check these: