Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-36026
CVE-2024-36026:
Linux Kernel vulnerability analysis and mitigation
Overview
CVE-2024-36026 affects the Linux kernel's AMD graphics driver, specifically the power management component for SMU v13.0.4/11. The vulnerability was discovered and disclosed on May 30, 2024, and involves a random system hang during S4 (hibernate) state transitions. The issue affects various Linux distributions and kernel versions that use the AMD graphics driver with the specified SMU version (NVD).
Technical details
The vulnerability occurs when performing multiple S4 (hibernate) stress tests, where the Graphics Controller (GC), Run List Controller (RLC), and Power Management Firmware (PMFW) can enter an invalid state, resulting in hard system hangs. The issue is specifically related to the state transition handling in the AMD driver's power management component. The fix involves adding a Graphics (GFX) reset as a workaround just before sending the MP1_UNLOAD message to prevent the components from entering an invalid state (Kernel Commit).
Impact
When exploited, this vulnerability can cause system stability issues, specifically resulting in hard hangs during S4 (hibernate) operations. This primarily affects systems using AMD graphics hardware with SMU v13.0.4/11, potentially disrupting system operation and requiring a hard reset to recover (NVD).
Mitigation and workarounds
The issue has been fixed in the Linux kernel through a patch that implements a GFX reset workaround. The fix has been integrated into various kernel versions and distributions. Ubuntu 24.04 LTS (Noble) has fixed the issue in version 6.8.0-38.38, and similar fixes have been applied to other kernel variants. Users are advised to update their systems to the patched versions (Ubuntu Security).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management