CVE-2024-42228: Linux Kernel Uninitialized Value Vulnerability

CVE-2024-42228 Overview

CVE-2024-42228 is a high-severity vulnerability in the Linux kernel's AMD GPU (amdgpu) Direct Rendering Manager (DRM) driver. The flaw resides in the Video Compression Engine (VCE) command stream parser, where the size variable is used uninitialized when calling amdgpu_vce_cs_reloc. The issue affects command stream handling, specifically the 0x03000001 case path. A local authenticated attacker with the ability to submit GPU command buffers can leverage the uninitialized value to impact confidentiality, integrity, and availability of the affected system. The vulnerability is tracked under [CWE-908: Use of Uninitialized Resource].

Critical Impact
Local low-privileged users can exploit uninitialized memory in the amdgpu VCE driver to cause kernel memory corruption, denial of service, or potential privilege escalation on systems with AMD GPUs.

Affected Products

Linux Kernel (multiple stable branches prior to fixed commits)
Debian LTS distributions (addressed in October 2024 and January 2025 advisories)
Systems running AMD GPU hardware with the amdgpu DRM kernel driver enabled

Discovery Timeline

2024-07-30 - CVE-2024-42228 published to NVD
2024-10 - Debian LTS security advisory issued
2025-01 - Additional Debian LTS security advisory issued
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-42228

Vulnerability Analysis

The vulnerability exists in the AMD GPU DRM driver's VCE command stream relocation logic. When the kernel processes a VCE command buffer submitted from userspace, it invokes amdgpu_vce_cs_reloc to validate and patch relocations referenced by the command stream. The size parameter passed to this function was not initialized in all code paths, including the 0x03000001 command case. As a result, the function operated on stack-resident garbage data, leading to undefined behavior during buffer validation and relocation patching.

The upstream maintainer note indicates that a complete fix would require a distinct sentinel value of 0xffffffff to mark uninitialized state explicitly. The applied patch initializes size before invocation as a defensive correction.

Root Cause

The root cause is improper variable initialization in the amdgpu_vce_cs command parser. The local size variable is written only on certain command opcode branches but read unconditionally before passing into amdgpu_vce_cs_reloc. Untouched stack memory carries attacker-influenceable values from prior frames, violating the kernel's input validation contract on a privileged path.

Attack Vector

Exploitation requires local access and the ability to open the /dev/dri/renderD* or /dev/dri/card* device nodes and issue DRM_IOCTL_AMDGPU_CS ioctls. An attacker crafts a VCE command stream that triggers the vulnerable opcode path, causing the kernel to use uninitialized stack data as a size value during relocation. This can lead to out-of-bounds buffer operations within kernel address space, denial of service via kernel oops, or memory corruption that may be chained toward privilege escalation. The attack complexity is high because the attacker must control or predict the stack contents and chain the primitive into a usable exploit.

No verified public proof-of-concept code is available. Technical detail is available in the upstream commits referenced in the Kernel Git Commit Change 1 and the Debian LTS Announcement October 2024.

Detection Methods for CVE-2024-42228

Indicators of Compromise

Unexpected kernel oops or warning messages referencing amdgpu_vce_cs, amdgpu_vce_cs_reloc, or VCE command parsing in dmesg or /var/log/kern.log
Unprivileged processes opening /dev/dri/renderD* and issuing high volumes of DRM_IOCTL_AMDGPU_CS calls with anomalous VCE payloads
Kernel address sanitizer (KASAN) reports involving uninitialized reads in the drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c code path

Detection Strategies

Inventory Linux hosts running AMD GPU hardware and verify kernel package versions against fixed upstream commits
Monitor kernel ring buffer for crash signatures in the amdgpu VCE subsystem and correlate with the originating user and process
Apply EDR telemetry rules that flag unprivileged processes accessing DRM render nodes outside expected workloads such as media encoding services or container runtimes

Monitoring Recommendations

Centralize dmesg and journalctl -k output to a SIEM and alert on amdgpu-related kernel warnings or oopses
Track process-to-device-node access patterns for /dev/dri/* and baseline legitimate GPU workloads
Audit container and sandbox configurations that expose GPU devices to untrusted workloads

How to Mitigate CVE-2024-42228

Immediate Actions Required

Apply vendor-supplied kernel updates from your Linux distribution that incorporate the upstream fix commits
Identify all hosts with AMD GPUs running amdgpu and prioritize patching of multi-user systems, shared workstations, and container hosts exposing GPU devices
Restrict access to /dev/dri/render* and /dev/dri/card* device nodes to trusted users and service accounts only

Patch Information

The Linux kernel maintainers resolved the issue by initializing the size variable prior to calling amdgpu_vce_cs_reloc. Fixes were merged in multiple stable branches via commits 855ae72c, 88a9a467, and f8f120b3. Debian addressed the issue through the Debian LTS Announcement October 2024 and the Debian LTS Announcement January 2025.

Workarounds

Unload the amdgpu kernel module on systems that do not require AMD GPU acceleration using modprobe -r amdgpu and blacklist it until patched
Remove access permissions on /dev/dri/render* for non-privileged users where GPU compute is not required
Disable VCE-dependent workloads such as untrusted hardware-accelerated video encoding until kernel updates are applied

bash

# Verify kernel version and applied amdgpu patch state
uname -r

# Check if the amdgpu module is loaded
lsmod | grep amdgpu

# Restrict DRM render node access to a trusted group
sudo chgrp render /dev/dri/renderD128
sudo chmod 0660 /dev/dri/renderD128

# Optional: blacklist amdgpu where GPU acceleration is not required
echo "blacklist amdgpu" | sudo tee /etc/modprobe.d/blacklist-amdgpu.conf
sudo update-initramfs -u