Security readout for executives and security teams
Plain-English summary
A memory-management flaw in Linux’s AMD GPU driver can access kernel memory after it has been freed during device shutdown or removal. A local, low-privileged user may be able to trigger serious consequences, potentially including system compromise or disruption. Systems without the AMDGPU driver or affected AMD graphics hardware are less likely to be exposed.
Executive priority
Treat as a high-priority local privilege risk on shared Linux workstations, GPU servers, and other AMDGPU-enabled systems with untrusted users. Patch during the next expedited maintenance window. Priority is lower for systems without AMDGPU exposure or where only trusted administrators can run local code, absent evidence of remote or active exploitation.
Technical view
CVE-2024-56551 is a CWE-416 slab use-after-free in drm_sched_entity_flush within the GPU scheduler, reached during AMDGPU VCE teardown. KASAN observed an eight-byte read after the scheduler object had been freed. The supplied CVSS 3.1 score is 7.8: local access, low complexity, low privileges, no user interaction, and potentially high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is primarily Linux hosts using the AMDGPU kernel driver on affected kernel branches. The supplied affected-version data is ambiguous and should not be treated as a complete package-level inventory. Internet exposure alone does not enable the documented local attack path; local account or code execution is indicated.
Exploitation context
The supplied record does not identify active exploitation, and the CVE is not listed as KEV. The documented failure occurred during AMD GPU device teardown and file closure. CVSS indicates a local, low-privileged attack path, but the bundle provides no public exploit evidence or confirmation that every affected configuration is practically exploitable.
Researcher notes
The trace places the stale read in drm_sched_entity_flush, called by drm_sched_entity_destroy during amdgpu_vce_sw_fini. Allocation occurred in drm_sched_init, while the object was freed before the later flush. Five stable-kernel commits are referenced, suggesting branch-specific backports. Exact affected and fixed boundaries cannot be reconstructed confidently from the flattened version list supplied.
Mitigation direction
- Install a vendor kernel update incorporating the applicable linked stable fix.
- Reboot into the updated kernel; installing packages alone leaves the running kernel vulnerable.
- Prioritize multi-user systems where untrusted users can access AMD GPU devices.
- If updates are unavailable, consult distribution guidance for supported temporary mitigations.
Validation and detection
- Inventory running kernel versions and systems loading the AMDGPU driver.
- Map distribution kernel packages to the linked upstream stable fixes.
- Confirm the updated kernel is active after reboot.
- Review kernel logs for KASAN reports, GPU scheduler faults, or unexpected AMDGPU teardown crashes.
- Use vendor advisories to resolve the ambiguous affected-version boundaries.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-56551 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3cc1116de10953f0265a05d9f351b02a9ec3b497CVE reference, Linux
- https://git.kernel.org/stable/c/05b1b33936b71e5f189a813a517f72e8a27fcb2fCVE reference, Linux
- https://git.kernel.org/stable/c/3990ef742c064e22189b954522930db04fc6b1a7CVE reference, Linux
- https://git.kernel.org/stable/c/6383199ada42d30562b4249c393592a2a9c38165CVE reference, Linux
- https://git.kernel.org/stable/c/b61badd20b443eabe132314669bb51a263982e5cCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.