Security readout for executives and security teams
Plain-English summary
A flaw in the Linux AMD graphics display driver can read outside a fixed-size array while creating a display link encoder. It requires local, low-privileged access according to CVSS and may affect confidentiality, integrity, and availability. The reported failure occurred while the amdgpu module was loading, so exposed systems should receive a corrected vendor kernel.
Executive priority
Treat this as a high-priority kernel maintenance issue for affected AMD graphics systems, especially multi-user endpoints. It is not supported as an internet-scale emergency because local access is required and active exploitation is unconfirmed. Patch through normal expedited kernel deployment, reboot, and verify coverage using distribution-specific package information.
Technical view
The dcn21_link_encoder_create function used hpd_source to index link_enc_hpd_regs without validating its bounds. The supplied trace shows index 7 used against a five-element array during amdgpu initialization. The Linux fix rejects an invalid index and returns NULL, preventing the out-of-bounds access and resulting undefined behavior.
Likely exposure
Exposure is most likely on systems running an affected Linux kernel and loading the amdgpu display driver on relevant AMD hardware. Systems without AMD graphics, without the amdgpu module, or whose vendor kernel contains the backported fix are less likely exposed. The supplied version data is ambiguous, so assess distribution packages rather than version strings alone.
Exploitation context
The CVSS 3.1 score is 7.8 with local access and low privileges required. The bundle does not identify remote exploitation, public weaponization, or active exploitation, and the CVE is not listed as KEV. The evidence demonstrates an out-of-bounds condition detected during driver initialization, not a proven real-world compromise.
Researcher notes
The supplied trace identifies dcn21_resource.c and an index of 7 against dcn10_link_enc_hpd_registers[5]. The correction adds bounds validation before dereferencing and returns NULL for invalid hpd_source values. The bundle does not establish how an unprivileged user controls that value or whether exploitation beyond a sanitizer-detected access is practical.
Mitigation direction
- Install a vendor-supported kernel containing the applicable upstream fix or distribution backport.
- Reboot into the corrected kernel; installing a package alone does not replace the running kernel.
- Prioritize AMD GPU workstations, shared systems, and hosts permitting untrusted local users.
- If updates are delayed, consult the Linux distribution vendor for supported temporary mitigations.
Validation and detection
- Inventory running kernel versions and distribution package revisions across Linux systems.
- Identify systems with relevant AMD graphics hardware and the amdgpu module loaded.
- Confirm the vendor package maps to an upstream fix or cited security advisory.
- After rebooting, verify the corrected kernel is running.
- Review kernel logs for UBSAN array-index-out-of-bounds reports involving dcn21_link_encoder_create.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-56608 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/280f722601c8bf4d8a9c62dd727cf3a2fd0a47beCVE reference, Linux
- https://git.kernel.org/stable/c/b19ca8425a4b86e8f0d7c33c4e87ef7b0ebdaa29CVE reference, Linux
- https://git.kernel.org/stable/c/5bd410c21037107b83ffbb51dd2d6460f9de9ed1CVE reference, Linux
- https://git.kernel.org/stable/c/08ac5fdb9c6dc34d0ed4bc64ce3c5c3d411b3b53CVE reference, Linux
- https://git.kernel.org/stable/c/f01ddd589e162979421e6914b1c74018633f01e0CVE reference, Linux
- https://git.kernel.org/stable/c/63de35a8fcfca59ae8750d469a7eb220c7557bafCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.