CVE-2024-36969: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-36969 is a vulnerability in the Linux kernel's AMD display driver (drm/amd/display) discovered in June 2024. The issue occurs in the setup_dsc_config function where a division by zero can occur when the slice_height parameter is 0, leading to a driver crash. This vulnerability affects multiple versions of the Linux kernel up to versions 5.15.160, 6.1.92, 6.6.32, 6.8.11, and 6.9.2 (NVD).

The vulnerability is caused by an unchecked division operation in the setup_dsc_config function within the AMD display driver. When slice_height is 0, the calculation of num_slices_v (pic_height/slice_height) results in a division by zero error. The issue has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access required with low complexity and no user interaction needed (NVD).

When triggered, the vulnerability causes the AMD GPU driver to crash, leaving the kernel in a state that requires a system reboot. This was specifically reproduced on a Lenovo ThinkPad Z16 Gen 2 with an Apple Studio Display monitor connected via Thunderbolt (Kernel Patch).

The vulnerability requires local access and can be triggered when connecting certain display configurations, particularly when rebooting the system with specific monitors connected. The issue was confirmed to be reproducible on specific hardware configurations (Kernel Patch).

A patch has been developed and merged into the Linux kernel that adds a check to avoid the division by zero condition. The fix involves verifying that slice_height is greater than 0 before performing the division operation. If slice_height is 0, the DSC configuration is marked as not possible (Kernel Patch).