Security readout for executives and security teams
Plain-English summary
A Linux AMD GPU power-management bug allocates 152 bytes for a metrics table but clears 168 bytes, writing beyond allocated kernel memory. On affected Vangogh-based systems, a local low-privileged user may trigger kernel memory corruption, potentially affecting confidentiality, integrity, or availability.
Executive priority
Treat as a high-priority endpoint patching issue, especially for shared or less-trusted Vangogh-based Linux systems. It requires local access, reducing internet-facing urgency, but kernel memory corruption carries serious potential impact. Confirm affected hardware and distribution packages promptly.
Technical view
CVE-2024-50221 is a CWE-787 slab out-of-bounds write in amdgpu’s Vangogh GPU-metrics path. smu_cmn_init_soft_gpu_metrics() writes 168 bytes into a 152-byte allocation created during Vangogh table initialization. KASAN observed the condition while a user process read GPU metrics through sysfs.
Likely exposure
Exposure is limited to Linux systems using the affected amdgpu Vangogh GPU-metrics code. The supplied record identifies affected Linux releases beginning with 6.6 and names later release boundaries, but its flattened version data does not establish every distribution-specific affected package.
Exploitation context
CVSS 3.1 rates this 7.8: local access, low complexity, low privileges, and no user interaction, with potentially high confidentiality, integrity, and availability impact. The supplied record is not in KEV and provides no evidence of active exploitation or a public exploit.
Researcher notes
The observed path runs from sysfs GPU-metrics reads through vangogh_get_gpu_metrics_v2_4() to the oversized memset. The correction allocates for the largest expected metrics structure. The source calls this a brute-force fix and suggests later consolidating version-to-size logic. No demonstrated privilege escalation or exploitation is provided.
Mitigation direction
- Update to a vendor-supported kernel containing one of the cited Linux stable fixes.
- Check distribution advisories to confirm the precise fixed package for each deployed kernel branch.
- Prioritize Vangogh-based endpoints where untrusted or lower-privileged users can run local processes.
- If updates are delayed, follow vendor guidance for limiting exposure to the affected amdgpu metrics path.
Validation and detection
- Inventory kernel versions and identify systems loading amdgpu on Vangogh-class hardware.
- Compare installed distribution packages against vendor advisories and the cited stable fix commits.
- Confirm the deployed kernel source or package includes the applicable upstream correction.
- After updating, verify normal GPU metrics access and review kernel logs for memory-safety warnings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-50221 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f111de0f010308949254ee1cc45df8e6b8e1d7d4CVE reference, Linux
- https://git.kernel.org/stable/c/f8fd9f0d57af4f8f48b383ec28287af85b47cb9fCVE reference, Linux
- https://git.kernel.org/stable/c/4aa923a6e6406b43566ef6ac35a3d9a3197fa3e8CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.