CVE-2024-49908: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability (CVE-2024-49908) was discovered in the AMD display driver. The issue involves a potential null pointer dereference in the amdgpu_dm_update_cursor function. The vulnerability affects Linux kernel versions up to (excluding) 6.11.3. This issue was discovered and patched in August 2024 (Kernel Patch).

The vulnerability stems from a missing null pointer check in the amdgpu_dm_update_cursor function. Specifically, the 'afb' variable was assumed to be null at line 8388 but was later used in the code without proper validation, potentially leading to a null pointer dereference. The issue has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified as CWE-476 (NULL Pointer Dereference) (NVD).

If exploited, this vulnerability could lead to a system crash (denial of service) through a null pointer dereference in the AMD display driver. The impact is limited to availability, with no direct impact on confidentiality or integrity of the system (NVD).

The vulnerability requires local access with low privileges and no user interaction. The attack complexity is low, making it relatively straightforward to exploit if an attacker has the necessary local access (NVD).

The vulnerability has been fixed by adding a null check for the 'afb' variable before its use in the amdgpu_dm_update_cursor function. Users should update their Linux kernel to version 6.11.3 or later to receive the fix. The patch has been included in various Linux distributions' security updates, including Ubuntu's USN-7170-1 and USN-7276-1 (Ubuntu Notice).