Security readout for executives and security teams
Plain-English summary
A Linux AMD display-driver bookkeeping flaw can mishandle graphics-plane references during state restoration. Under the stated local, low-privilege attack model, it may cause memory corruption, crashes, or potentially compromise the affected system. The source bundle rates it CVSS 7.8.
Executive priority
Treat as a high-priority endpoint remediation issue, especially on shared AMD-graphics systems. It is not evidenced as remotely or actively exploited, so prioritize below confirmed-exploited critical vulnerabilities while patching promptly through normal kernel maintenance.
Technical view
The AMD DRM display code backed up and restored plane state without preserving its current reference count. If that count changed between operations, restoration could produce leaks, double frees, or invalid memory access. The kernel fix caches the current count and reapplies it during restoration.
Likely exposure
Exposure requires an affected Linux kernel using the AMD display subsystem. The supplied version data identifies 4.15, 6.12.4, and 6.13 but does not provide sufficiently clear range semantics; verify distribution backports and kernel provenance individually.
Exploitation context
The CVSS vector describes local exploitation requiring low privileges, low complexity, and no user interaction, with possible confidentiality, integrity, and availability impact. The bundle marks KEV false and supplies no evidence of active exploitation or a public exploit.
Researcher notes
The record maps CWE-415 and describes double-free, invalid-access, and leak outcomes caused by stale plane reference counts. Exact reachability, triggering conditions, affected range boundaries, and exploitability beyond the CVSS assumptions are not established by the supplied evidence.
Mitigation direction
- Apply a vendor-supported kernel update containing the referenced plane-refcount fix.
- Check distribution security guidance for backported fixes rather than relying only on upstream version numbers.
- Prioritize multi-user workstations and other systems where untrusted local users can access affected graphics functionality.
- If immediate updating is impossible, restrict untrusted local access and follow vendor-provided mitigations.
Validation and detection
- Inventory Linux kernel versions and identify systems using AMD display hardware or drivers.
- Confirm the installed kernel includes either referenced fix or an equivalent vendor backport.
- Review vendor advisories and package changelogs because distribution kernel versions may not match upstream numbering.
- After updating, verify the fixed kernel is running and affected older kernels are no longer booted.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-415: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-56775 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8cb2f6793845f135b28361ba8e96901cae3e5790CVE reference, Linux
- https://git.kernel.org/stable/c/27227a234c1487cb7a684615f0749c455218833aCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Double Free
Double Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.