CVE-2024-46805: Linux Kernel Use-After-Free Vulnerability

CVE-2024-46805 Overview

CVE-2024-46805 is a Null Pointer Dereference vulnerability in the Linux kernel's AMD GPU driver (drm/amdgpu). The vulnerability exists in the handling of amdgpu_hive_info *hive structures, where the code fails to properly validate that the hive pointer is not NULL before dereferencing it. This missing NULL check can lead to a kernel crash when the affected code path is executed with an uninitialized or invalid hive structure.

Critical Impact
Local attackers with low privileges can trigger a denial of service condition by exploiting the NULL pointer dereference, causing kernel crashes and system instability on systems with AMD GPUs.

Affected Products

Linux Kernel (multiple versions)
Systems with AMD GPU hardware using the drm/amdgpu driver
Debian-based distributions (confirmed via Debian LTS announcement)

Discovery Timeline

September 27, 2024 - CVE-2024-46805 published to NVD
November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2024-46805

Vulnerability Analysis

This vulnerability (CWE-476: NULL Pointer Dereference) occurs within the drm/amdgpu driver subsystem of the Linux kernel. The AMD GPU driver manages GPU hive information structures (amdgpu_hive_info) that coordinate multi-GPU configurations and resource sharing. When certain driver functions attempt to access properties or methods of the hive structure without first verifying its validity, a NULL pointer dereference can occur.

The local attack vector means an attacker needs local access to the system, though only low privileges are required to trigger the vulnerability. The impact is primarily availability-focused, as successful exploitation results in a denial of service through kernel panic or system crash rather than information disclosure or code execution.

Root Cause

The root cause is insufficient input validation in the drm/amdgpu driver code. Specifically, the amdgpu_hive_info *hive pointer was being dereferenced without a preceding NULL check. In multi-GPU environments or certain initialization scenarios, this hive pointer may legitimately be NULL, and the code should gracefully handle this condition rather than assuming the pointer is always valid.

Attack Vector

The vulnerability requires local access to the system with low-level privileges. An attacker can trigger the vulnerable code path through:

Interaction with AMD GPU driver interfaces exposed to userspace
Triggering specific GPU operations that access hive management functions
Manipulating GPU configuration states that result in NULL hive conditions

The attack does not require user interaction and can be triggered programmatically once the attacker has local system access. The vulnerability is limited to causing system availability impact through kernel crashes.

Detection Methods for CVE-2024-46805

Indicators of Compromise

Kernel panic or oops messages referencing drm/amdgpu driver components
System crashes during GPU-intensive operations or multi-GPU workloads
Kernel log entries showing NULL pointer dereference in AMD GPU driver stack traces
Unexpected system reboots on systems with AMD graphics hardware

Detection Strategies

Monitor kernel logs (dmesg, /var/log/kern.log) for NULL pointer dereference errors in amdgpu driver
Implement crash dump analysis to identify kernel panics originating from drm/amdgpu subsystem
Use kernel tracing tools to monitor amdgpu driver function calls for abnormal termination
Deploy system stability monitoring to detect unusual crash patterns on AMD GPU systems

Monitoring Recommendations

Configure kernel crash dump collection (kdump) to capture detailed crash information
Set up alerting for kernel oops and panic events in centralized logging systems
Monitor AMD GPU driver module loading and initialization for errors
Track system uptime anomalies on servers with AMD GPU hardware

How to Mitigate CVE-2024-46805

Immediate Actions Required

Update the Linux kernel to a patched version that includes the NULL check fix
Review and apply vendor security updates from your Linux distribution
Limit local access to systems with AMD GPUs to trusted users only
Consider temporarily restricting GPU driver access if patches cannot be immediately applied

Patch Information

The vulnerability has been addressed through multiple kernel patches that add proper NULL validation for the amdgpu_hive_info pointer before dereferencing. The following commits contain the fix:

Commit 01cd55b971131b07b7ff8d622fa93bb4f8be07df - Linux Kernel Commit
Commit 1940708ccf5aff76de4e0b399f99267c93a89193 - Linux Kernel Commit
Commit 4ab720b6aa1ef5e71db1e534b5b45c80ac4ec58a - Linux Kernel Commit
Commit d3f927ef0607b3c8c3f79ab6d9a4ebead3e35f4c - Linux Kernel Commit
Commit f20d1d5cbb39802f68be24458861094f3e66f356 - Linux Kernel Commit

Debian users should refer to the Debian LTS Announcement for distribution-specific patch information.

Workarounds

Restrict local user access to minimize the attack surface for exploitation
Implement mandatory access control (SELinux/AppArmor) policies to limit GPU driver access
Monitor for and respond quickly to kernel crash events
Consider disabling the amdgpu driver on non-critical systems until patches can be applied

bash

# Check current kernel version
uname -r

# Verify if amdgpu module is loaded
lsmod | grep amdgpu

# Check for available kernel updates (Debian/Ubuntu)
apt update && apt list --upgradable | grep linux

# Check for available kernel updates (RHEL/CentOS)
yum check-update kernel