Security readout for executives and security teams
Plain-English summary
A Linux AMD display-driver flaw can crash the system when a display pipeline has an improperly set index. The supplied CVSS assessment also indicates possible confidentiality and integrity impact, although the source description documents only a driver crash. Exploitation requires local, low-privileged access and no user interaction.
Executive priority
Treat as a high-priority endpoint stability issue where affected AMD graphics and untrusted local access coincide. Patch through normal expedited kernel maintenance after vendor confirmation. It is less urgent for systems without the applicable driver, and the supplied evidence does not support emergency action for active exploitation.
Technical view
CVE-2024-42064 affects Linux kernel drm/amd/display handling. An improperly initialized pipe index can reach driver processing and cause a crash. The upstream correction skips pipes whose index is not properly set. The supplied record lists affected Linux versions including 6.7, 6.9.8, and 6.10, but its version-boundary data is ambiguous.
Likely exposure
Exposure is most plausible on systems running an affected Linux kernel with the AMD display driver active. Desktops, workstations, and shared systems permitting untrusted local access deserve attention. Systems without applicable AMD display hardware or driver use are less likely exposed, but distribution backports must be checked.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges, with no user interaction. The supplied bundle says this CVE is not in KEV and provides no evidence of active exploitation or a public exploit. The documented outcome is a driver crash; broader impacts come from the CVSS assessment.
Researcher notes
The source identifies invalid pipe-index handling and a defensive skip as the correction. No CWE is assigned. The CVSS claims high confidentiality, integrity, and availability impact, but the terse technical description substantiates only a crash. Exact vulnerable boundaries and downstream backports require distribution-specific confirmation.
Mitigation direction
- Install a vendor-supported kernel containing the applicable cited stable fix or documented backport.
- Prioritize shared systems and AMD-equipped endpoints where untrusted users can obtain local access.
- Consult the Linux distribution's advisory for exact fixed package versions and reboot requirements.
- Restrict unnecessary local accounts until affected systems are updated.
Validation and detection
- Record the running kernel version and compare it with the distribution's CVE advisory.
- Confirm whether applicable AMD graphics hardware and the AMD display driver are present and active.
- Verify the installed kernel contains either cited fix or an equivalent vendor backport.
- Review kernel logs for AMD display-driver crashes; absence of crashes does not prove safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42064 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/27df59c6071470efce7182ee92fbb16afba551e0CVE reference, Linux
- https://git.kernel.org/stable/c/af114efe8d24b5711cfbedf7180f2ac1a296c24bCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.