LiveActive security incident?Get immediate response
CVE Record

CVE-2024-41011: drm/amdkfd: don't allow mapping the MMIO HDP page with large pages

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: don't allow mapping the MMIO HDP page with large pages We don't get the right offset in that case. The GPU has an unused 4K area of the register BAR space into which you can remap registers. We remap the HDP flush registers into this space to allow userspace (CPU or GPU) to flush the HDP when it updates VRAM. However, on systems with >4K pages, we end up exposing PAGE_SIZE of MMIO space.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local, low-privileged user may gain unintended access to sensitive AMD GPU register memory on Linux systems using page sizes larger than 4 KB. Successful abuse could compromise confidentiality, integrity, and availability. Exposure depends on the AMD KFD driver, compatible hardware, and system page size, so this is serious but not universal.

Executive priority

Treat as high priority for shared AMD GPU compute systems with large memory pages and untrusted local users or tenants. Patch through supported kernel channels promptly. Lower the priority only after confirming 4 KB pages, no relevant AMD KFD exposure, or a vendor-confirmed fixed kernel.

Technical view

The AMD KFD driver maps a 4 KB MMIO area containing remapped HDP flush registers. On systems where PAGE_SIZE exceeds 4 KB, the mapping can expose additional register BAR space because the offset is incorrect for large pages. CVSS 3.1 rates this 7.8: local access, low complexity, low privileges, no user interaction, and high impact across confidentiality, integrity, and availability.

Likely exposure

Prioritize Linux hosts with AMD GPUs, the amdkfd driver available or loaded, untrusted local users or workloads, and a system page size above 4 KB. Typical 4 KB-page systems do not match the described trigger. The supplied version data is flattened and insufficient for safely declaring precise vulnerable ranges; verify against distribution and kernel guidance.

Exploitation context

The supplied record marks this CVE as absent from CISA KEV and provides no evidence of active exploitation or a public exploit. Exploitation requires local, low-privileged access and the specific AMD KFD and large-page conditions. Network-only attackers are not directly represented by the CVSS vector, although compromised local workloads could potentially provide the required foothold.

Researcher notes

The core boundary failure is an oversized MMIO mapping: PAGE_SIZE bytes are exposed although the intended remapped register window is 4 KB. The sources do not identify a CWE, observed exploitation, or detailed attack outcomes. Exact affected-version interpretation should rely on the CVE record’s range data and distribution advisories rather than the bundle’s flattened version list.

Mitigation direction

  • Apply a vendor-supported kernel containing the referenced stable fix.
  • Prioritize multi-user and shared-compute AMD GPU systems using page sizes above 4 KB.
  • Where patching is delayed, restrict untrusted access to affected GPU compute interfaces.
  • Review Linux distribution advisories for exact package versions and reboot requirements.

Validation and detection

  • Record kernel version, architecture, configured page size, and AMD GPU presence.
  • Confirm whether amdkfd is loaded or accessible to untrusted local users or workloads.
  • Compare the running kernel package with vendor advisories and referenced stable commits.
  • After updating, reboot and confirm the corrected kernel is running.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-41011 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-41011Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd8e408a82704c86ba87c3d58cfe69dcdb758aa07, d8e408a82704c86ba87c3d58cfe69dcdb758aa07, d8e408a82704c86ba87c3d58cfe69dcdb758aa07, d8e408a82704c86ba87c3d58cfe69dcdb758aa07, d8e408a82704c86ba87c3d58cfe69dcdb758aa07, d8e408a82704c86ba87c3d58cfe69dcdb758aa07, d8e408a82704c86ba87c3d58cfe69dcdb758aa07unaffected
LinuxLinux5.3, 0, 5.4.283, 5.10.225, 5.15.166, 6.1.91, 6.6.31, 6.8.10, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.