CVE-2024-46805: Linux Kernel Use-After-Free Vulnerability

CVE-2024-46805 Overview

CVE-2024-46805 is a Null Pointer Dereference vulnerability in the Linux kernel's AMD GPU driver (drm/amdgpu). The vulnerability exists in the handling of amdgpu_hive_info *hive structures, where the code fails to properly validate that the hive pointer is not NULL before dereferencing it. This missing NULL check can lead to a kernel crash when the affected code path is executed with an uninitialized or invalid hive structure.

Critical Impact

Local attackers with low privileges can trigger a denial of service condition by exploiting the NULL pointer dereference, causing kernel crashes and system instability on systems with AMD GPUs.

Affected Products

• Linux Kernel (multiple versions)
• Systems with AMD GPU hardware using the drm/amdgpu driver
• Debian-based distributions (confirmed via Debian LTS announcement)

Discovery Timeline

• September 27, 2024 - CVE-2024-46805 published to NVD
• November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2024-46805

Vulnerability Analysis

This vulnerability (CWE-476: NULL Pointer Dereference) occurs within the drm/amdgpu driver subsystem of the Linux kernel. The AMD GPU driver manages GPU hive information structures (amdgpu_hive_info) that coordinate multi-GPU configurations and resource sharing. When certain driver functions attempt to access properties or methods of the hive structure without first verifying its validity, a NULL pointer dereference can occur.

The local attack vector means an attacker needs local access to the system, though only low privileges are required to trigger the vulnerability. The impact is primarily availability-focused, as successful exploitation results in a denial of service through kernel panic or system crash rather than information disclosure or code execution.

Root Cause

The root cause is insufficient input validation in the drm/amdgpu driver code. Specifically, the amdgpu_hive_info *hive pointer was being dereferenced without a preceding NULL check. In multi-GPU environments or certain initialization scenarios, this hive pointer may legitimately be NULL, and the code should gracefully handle this condition rather than assuming the pointer is always valid.

Attack Vector

The vulnerability requires local access to the system with low-level privileges. An attacker can trigger the vulnerable code path through:

1. Interaction with AMD GPU driver interfaces exposed to userspace
2. Triggering specific GPU operations that access hive management functions
3. Manipulating GPU configuration states that result in NULL hive conditions

The attack does not require user interaction and can be triggered programmatically once the attacker has local system access. The vulnerability is limited to causing system availability impact through kernel crashes.

Detection Methods for CVE-2024-46805

Indicators of Compromise

• Kernel panic or oops messages referencing drm/amdgpu driver components
• System crashes during GPU-intensive operations or multi-GPU workloads
• Kernel log entries showing NULL pointer dereference in AMD GPU driver stack traces
• Unexpected system reboots on systems with AMD graphics hardware

Detection Strategies

• Monitor kernel logs (dmesg, /var/log/kern.log) for NULL pointer dereference errors in amdgpu driver
• Implement crash dump analysis to identify kernel panics originating from drm/amdgpu subsystem
• Use kernel tracing tools to monitor amdgpu driver function calls for abnormal termination
• Deploy system stability monitoring to detect unusual crash patterns on AMD GPU systems

Monitoring Recommendations

• Configure kernel crash dump collection (kdump) to capture detailed crash information
• Set up alerting for kernel oops and panic events in centralized logging systems
• Monitor AMD GPU driver module loading and initialization for errors
• Track system uptime anomalies on servers with AMD GPU hardware

How to Mitigate CVE-2024-46805

Immediate Actions Required

• Update the Linux kernel to a patched version that includes the NULL check fix
• Review and apply vendor security updates from your Linux distribution
• Limit local access to systems with AMD GPUs to trusted users only
• Consider temporarily restricting GPU driver access if patches cannot be immediately applied

Patch Information

The vulnerability has been addressed through multiple kernel patches that add proper NULL validation for the amdgpu_hive_info pointer before dereferencing. The following commits contain the fix:

• Commit 01cd55b971131b07b7ff8d622fa93bb4f8be07df - Linux Kernel Commit
• Commit 1940708ccf5aff76de4e0b399f99267c93a89193 - Linux Kernel Commit
• Commit 4ab720b6aa1ef5e71db1e534b5b45c80ac4ec58a - Linux Kernel Commit
• Commit d3f927ef0607b3c8c3f79ab6d9a4ebead3e35f4c - Linux Kernel Commit
• Commit f20d1d5cbb39802f68be24458861094f3e66f356 - Linux Kernel Commit

Debian users should refer to the Debian LTS Announcement for distribution-specific patch information.

Workarounds

• Restrict local user access to minimize the attack surface for exploitation
• Implement mandatory access control (SELinux/AppArmor) policies to limit GPU driver access
• Monitor for and respond quickly to kernel crash events
• Consider disabling the amdgpu driver on non-critical systems until patches can be applied

# Check current kernel version
uname -r

# Verify if amdgpu module is loaded
lsmod | grep amdgpu

# Check for available kernel updates (Debian/Ubuntu)
apt update && apt list --upgradable | grep linux

# Check for available kernel updates (RHEL/CentOS)
yum check-update kernel