CVE-2024-56775

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable code is reached only through DRM atomic-commit/page-flip ioctls on the local `/dev/dri/card*` node (amdgpu_dm_atomic_commit_tail → dc_update_planes_and_stream), which requires local access to the machine. There is no remote or network-facing path into the amdgpu display core.

AC:LAttack complexity, low

Userspace directly controls the plane topology, so it can deterministically drive UPDATE_TYPE_FULL commits that add/remove MPO planes and force the minimal-transition path where a plane's refcount changes between backup and restore. No condition outside the attacker's control is needed, and the sequence can be repeated in a loop until the corrupted refcount reaches zero.

PR:LPrivileges required, low

An ordinary unprivileged user with a graphical seat (logind session or `video` group membership) is DRM master on the primary node and may issue atomic commits with overlay planes; no root or CAP_SYS_ADMIN is required.

UI:NUser interaction, none

The attacker triggers the faulty backup/restore sequence entirely through its own atomic commits; no victim action such as mounting media or opening a file is involved.

S:UScope, unchanged

The corruption stays within the kernel of the same machine and the impact is on kernel memory under the same security authority; no VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

Stomping the kref with a stale lower value causes premature kvfree() of the kvzalloc'd `dc_plane_state` while pipe contexts still reference it, so the attacker can reclaim the freed slab object and read back kernel memory through the dangling references — a use-after-free read primitive.

I:HIntegrity impact, high

The same use-after-free/double-free lets the attacker spray a controlled object into the freed allocation, and subsequent writes through the stale `plane_states[i]` pointers (including the function-pointer-bearing sub-structures freed in dc_plane_destruct) yield an arbitrary-write / control-flow-hijack primitive.

A:HAvailability impact, high

Even without full exploitation, the mismatched refcount produces double frees and invalid memory accesses that oops or panic the kernel; the leak case (refcount restored too high) additionally exhausts memory over repeated commits.