Security readout for executives and security teams
Plain-English summary
A flaw in the Linux AMDGPU driver mishandles the order of memory-move notifications, leaving required old-location information unavailable. The supplied CVSS score is 7.8, reflecting potentially serious confidentiality, integrity, and availability consequences for an attacker who already has local low-privilege access.
Executive priority
Treat this as a high-priority kernel maintenance issue on confirmed AMDGPU systems, especially shared or multi-user hosts. It is not an internet-wide emergency because exploitation requires local access and active exploitation is not established. Complete vendor-guided updates promptly within the normal urgent patch cycle.
Technical view
In amdgpu_ttm_move(), the move notification occurred after the buffer move, when the old location was no longer available. This also produced incorrect ordering for DMA-buf and virtual-memory notifications. The resolution restores notification before movement, revises eviction-statistic handling, and adds a missing NULL check.
Likely exposure
Exposure is limited to Linux systems using the AMDGPU driver and an affected kernel build. The supplied version data includes ambiguous entries, including "0", so administrators should confirm exposure using distribution advisories, package changelogs, or inclusion of the cited stable-kernel fixes rather than version strings alone.
Exploitation context
The CVSS vector requires local access, low privileges, low complexity, and no user interaction. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. It is not described as remotely exploitable.
Researcher notes
No CWE or precise exploitation primitive is supplied. The available description establishes notification-order, statistics, and NULL-check corrections but does not explain how an attacker reaches the condition. The affected-version representation is internally difficult to interpret; validate using vendor packages and the referenced kernel commits.
Mitigation direction
- Inventory Linux systems using AMDGPU hardware or the AMDGPU kernel driver.
- Install a vendor-supported kernel containing the applicable stable fix.
- Prioritize multi-user workstations and shared GPU compute systems with untrusted local users.
- Reboot where required and confirm the updated kernel is active.
- Consult distribution guidance where package-to-upstream version mapping is unclear.
Validation and detection
- Record the running kernel release and package build on every AMDGPU system.
- Confirm the installed package changelog references this CVE or a cited stable fix.
- Verify whether the AMDGPU driver is active on each potentially affected host.
- Check for pending reboots that leave an older vulnerable kernel running.
- After updating, test GPU workloads and review kernel logs for regressions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-27400 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5c25b169f9a0b34ee410891a96bc9d7b9ed6f9beCVE reference, Linux
- https://git.kernel.org/stable/c/0c7ed3ed35eec9138b88d42217b5a6b9a62bda4dCVE reference, Linux
- https://git.kernel.org/stable/c/9a4f6e138720b6e9adf7b82a71d0292f3f276480CVE reference, Linux
- https://git.kernel.org/stable/c/d3a9331a6591e9df64791e076f6591f440af51c3CVE reference, Linux
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTB4HWU2PTVW5NEYHHLOCXDKG3PYA534/CVE reference, CVE · x_transferred
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DW2MIOIMOFUSNLHLRYX23AFR36BMKD65/CVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.