Security readout for executives and security teams
Plain-English summary
A Linux AMD GPU driver flaw can leave a valid graphics-memory mapping pointing to a stale system page after memory is released. Later accidental GPU access may read undefined data instead of faulting. This can obscure the underlying failure and may affect confidentiality, integrity, or availability under the supplied CVSS assumptions.
Executive priority
Treat this as a high-priority kernel maintenance issue for AMD GPU fleets, especially multi-user or untrusted-workload systems. Prioritize inventory and supported kernel updates, but the current evidence does not justify an active-exploitation emergency response.
Technical view
The amdgpu GTT binding path failed to set the bound state correctly. Consequently, backend unbinding might not clear a GART page-table entry after releasing the GTT buffer object and its address space, leaving a stale mapping. The cited Linux stable commits correct this state-management issue.
Likely exposure
Exposure is most likely on Linux systems running affected kernels with AMD GPUs using the amdgpu driver and GTT/GART memory paths. The supplied version data is not a clean range, so administrators should verify distribution-specific kernel status rather than relying solely on listed numbers.
Exploitation context
The supplied CVSS 3.1 score is 7.8 and assumes local access, low privileges, low complexity, and no user interaction. KEV is false, and the bundle provides no evidence of active exploitation or a public exploit. Practical exploitability and security impact beyond undefined GPU reads remain unclear.
Researcher notes
The record describes stale GART mapping caused by incorrect GTT bound-state handling. No CWE is supplied. The affected-version data contains duplicate commit entries and ambiguous version points, limiting exact range conclusions. The sources establish upstream fixes but do not demonstrate exploitation, reliable triggering, or observed attacks.
Mitigation direction
- Install a vendor-supported Linux kernel incorporating the applicable cited stable fix.
- Follow the Linux distributor's security guidance when mapping packaged kernel versions to upstream fixes.
- If patching is delayed, restrict local access to affected AMD GPU systems.
- Reboot after updating so the corrected kernel and driver are active.
Validation and detection
- Inventory systems with AMD GPUs and determine whether the amdgpu driver is loaded.
- Record each running kernel version and compare it with distributor advisories and applicable stable commits.
- Confirm the updated kernel contains the relevant fix, then verify that kernel is running.
- Review kernel and GPU logs, while recognizing that absent errors do not prove safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-35817 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5d5f1a7f3b1039925f79c7894f153c2a905201fbCVE reference, Linux
- https://git.kernel.org/stable/c/589c414138a1bed98e652c905937d8f790804efeCVE reference, Linux
- https://git.kernel.org/stable/c/6fcd12cb90888ef2d8af8d4c04e913252eee4ef3CVE reference, Linux
- https://git.kernel.org/stable/c/e8d27caef2c829a306e1f762fb95f06e8ec676f6CVE reference, Linux
- https://git.kernel.org/stable/c/5cdce3dda3b3dacde902f63a8ee72c2b7f91912dCVE reference, Linux
- https://git.kernel.org/stable/c/6c6064cbe58b43533e3451ad6a8ba9736c109ac3CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.