Security readout for executives and security teams
Plain-English summary
A Linux AMD display-driver flaw can use an invalid GPIO identifier as an array index, causing memory overruns. The supplied CVSS rating is 7.8 (high): exploitation requires low-privileged local access but no user interaction, with potentially serious confidentiality, integrity, and availability impact.
Executive priority
Treat this as a high-priority endpoint and workstation remediation item, not an unauthenticated internet emergency. Accelerate patching where untrusted or numerous local users can access AMD-graphics Linux systems. Validate exposure before escalating headless or unrelated systems.
Technical view
Within drm/amd/display, GPIO_ID_UNKNOWN (-1) could reach an array access without prior validation. The Linux fix checks gpio_id before indexing. Coverity identified five overrun instances. The CVSS vector indicates local attack access, low complexity, low privileges, unchanged scope, and high modeled impact across confidentiality, integrity, and availability.
Likely exposure
Exposure is most likely on systems running an affected Linux kernel where the AMD display component and relevant hardware path are present. Workstations and other locally accessible AMD-graphics systems deserve priority. The supplied version data does not preserve clear range boundaries, so distribution-specific kernel mapping is necessary.
Exploitation context
The supplied record indicates a local, low-privilege attack vector with no user interaction. It does not establish a practical exploitation method or precondition beyond the affected driver condition. The CVE is not marked as KEV, and no included source reports active exploitation.
Researcher notes
The underlying defect is an unchecked negative sentinel used as an array index, with five overruns reported by Coverity. Seven stable-tree fixes are referenced. Exact affected and corrected release boundaries are ambiguous in the supplied normalized version list; use the CVE record, stable commits, and distribution advisories for branch-specific conclusions.
Mitigation direction
- Install a distribution-supported kernel update incorporating the applicable upstream stable fix.
- Reboot affected systems into the updated kernel after installation.
- Consult the Linux distribution's advisory when package-to-upstream version mapping is unclear.
- Prioritize locally accessible systems with AMD graphics and the affected display component.
Validation and detection
- Inventory running kernel builds and AMD graphics hardware across Linux systems.
- Determine whether the drm/amd/display component is present and active on each candidate system.
- Map distribution kernel packages to the applicable upstream stable fix or vendor advisory.
- After updating and rebooting, confirm the running kernel contains the correction.
- Re-scan affected assets and investigate any remaining detections against vendor version guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-46818 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8520fdc8ecc38f240a8e9e7af89cca6739c3e790CVE reference, Linux
- https://git.kernel.org/stable/c/40c2e8bc117cab8bca8814735f28a8b121654a84CVE reference, Linux
- https://git.kernel.org/stable/c/0184cca30cad74d88f5c875d4e26999e26325700CVE reference, Linux
- https://git.kernel.org/stable/c/276e3fd93e3beb5894eb1cc8480f9f417d51524dCVE reference, Linux
- https://git.kernel.org/stable/c/08e7755f754e3d2cef7d3a7da538d33526bd6f7cCVE reference, Linux
- https://git.kernel.org/stable/c/3d4198ab612ad48f73383ad3bb5663e6f0cdf406CVE reference, Linux
- https://git.kernel.org/stable/c/2a5626eeb3b5eec7a36886f9556113dd93ec8ed6CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.