Security readout for executives and security teams
Plain-English summary
A flaw in the Linux AMD display driver can access memory outside an allocated object when processing an unsupported writeback-connector feature. A local, low-privileged user may be able to trigger serious confidentiality, integrity, or availability impact. The supplied evidence does not establish remote reachability or active exploitation.
Executive priority
Treat this as a high-priority kernel maintenance issue, especially where untrusted users have local accounts or code execution. It does not warrant the same emergency response as a remotely exploitable or known-exploited vulnerability based on supplied evidence. Patch through normal expedited kernel-update processes and verify the running kernel afterward.
Technical view
The AMD DRM display code handled writeback connectors as though certain unsupported features were initialized, producing a KASAN slab-out-of-bounds finding. The upstream correction skips those operations when the connector type is DRM_MODE_CONNECTOR_WRITEBACK. CVSS 3.1 is 7.8: local access, low complexity, low privileges, no user interaction, and potentially high impact.
Likely exposure
Exposure is most likely on Linux systems using affected kernels, the AMD display driver, and relevant writeback-connector functionality. The supplied version data is ambiguous and contains duplicated commit identifiers, so determine exposure through distribution advisories and confirmation that the applicable stable fix is present.
Exploitation context
The CVSS vector describes local, low-privileged exploitation rather than a network attack. CISA KEV status is false in the supplied bundle, and no cited evidence establishes exploitation in the wild or a public weaponized exploit. Practical exploitability beyond the KASAN-detected condition remains unclear.
Researcher notes
The record attributes the fault to unsupported, uninitialized features on DRM writeback connectors and provides four stable-kernel corrections. No CWE is supplied. The CVSS claims high confidentiality, integrity, and availability impact, but the bundle does not explain a demonstrated exploitation primitive. Version-range interpretation should rely on the current CVE record and distribution-specific advisories.
Mitigation direction
- Install a vendor-supported kernel containing the applicable referenced stable fix.
- Reboot affected systems so the corrected kernel becomes active.
- Prioritize shared workstations and systems where untrusted users can execute local code.
- If updates are unavailable, obtain product-specific remediation guidance from the Linux distribution vendor.
Validation and detection
- Inventory running kernel versions and systems using AMD display hardware or drivers.
- Compare each kernel against its distribution advisory and the CVE version record.
- Confirm the installed kernel incorporates the applicable referenced stable commit.
- After rebooting, verify the corrected kernel is running.
- Review diagnostic logs for AMD display or KASAN slab-out-of-bounds reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-36914 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/87de0a741ef6d93fcb99983138a0d89a546a043cCVE reference, Linux
- https://git.kernel.org/stable/c/951a498fa993c5501994ec2df97c9297b02488c7CVE reference, Linux
- https://git.kernel.org/stable/c/e9baa7110e9f3756bd5a812af376c288d9be894dCVE reference, Linux
- https://git.kernel.org/stable/c/ecedd99a9369fb5cde601ae9abd58bca2739f1aeCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.