CVE-2024-50221
📋 TL;DR
This CVE describes a kernel memory out-of-bounds write vulnerability in the AMD GPU driver for Linux systems with Vangogh architecture GPUs. The vulnerability allows writing beyond allocated memory boundaries, potentially leading to kernel crashes or arbitrary code execution. Systems using affected AMD GPUs with the vulnerable Linux kernel driver are at risk.
💻 Affected Systems
- AMD Vangogh architecture GPUs (Steam Deck APU, custom AMD APUs)
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic, system crash, or potential arbitrary code execution with kernel privileges leading to complete system compromise.
Likely Case
System instability, kernel crashes, or denial of service when GPU metrics are accessed.
If Mitigated
Limited impact with proper kernel hardening and isolation, but still risk of system instability.
🎯 Exploit Status
Exploitation requires triggering GPU metrics operations, which typically requires local access or ability to run GPU-related commands.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel with commit 0880f58f9609f0200483a49429af0f050d281703 or later
Vendor Advisory: https://git.kernel.org/stable/c/4aa923a6e6406b43566ef6ac35a3d9a3197fa3e8
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing the fix. 2. Reboot system. 3. Verify AMDGPU driver loads without errors.
🔧 Temporary Workarounds
Disable AMDGPU driver for Vangogh
linuxPrevent loading of vulnerable AMDGPU driver module
echo 'blacklist amdgpu' >> /etc/modprobe.d/blacklist-amdgpu.conf
update-initramfs -u
reboot
🧯 If You Can't Patch
- Restrict GPU access to trusted users only
- Monitor system logs for KASAN reports or kernel crashes related to amdgpu
🔍 How to Verify
Check if Vulnerable:
Check kernel version and AMDGPU driver loading. Look for KASAN reports in dmesg output.Check Version:
uname -r && dmesg | grep -i amdgpuVerify Fix Applied:
Check that kernel version includes the fix commit. Verify no KASAN errors appear when accessing GPU metrics.📡 Detection & Monitoring
Log Indicators:
- KASAN: slab-out-of-bounds in smu_cmn_init_soft_gpu_metrics
- BUG: KASAN reports in dmesg
- Kernel panic related to amdgpu module
Network Indicators:
- None - local vulnerability only
SIEM Query:
source="kernel" AND ("KASAN" OR "slab-out-of-bounds" OR "amdgpu" AND "panic")