CVE-2024-47683 is a vulnerability identified in the Linux kernel, specifically within the Direct Rendering Manager (DRM) subsystem related to AMD GPU display handling. The flaw arises in the drm/amd/display driver code, where a NULL pointer dereference occurs during the Multi-Stream Transport (MST) and Display Stream Compression (DSC) setup process. The vulnerability manifests when the kernel attempts to recompute DSC parameters without verifying if a display stream is active on the link, leading to a NULL pointer dereference and consequent kernel crash (kernel oops). The root cause is that the code does not skip the recomputation of DSC parameters if no mode change is detected and no stream is present, which results in dereferencing a NULL pointer at address 0x8. The crash trace shows the fault occurring in the drm_dp_atomic_find_time_slots function within drm_display_helper, called during atomic mode setting operations in the AMD GPU driver (amdgpu). This can cause system instability or denial of service due to kernel panic. The vulnerability affects Linux kernel versions including the 6.3.9-arch1-1 build referenced, and likely other versions with similar drm/amd/display code. The fix involves adding logic to skip DSC recomputation if no mode change is detected and ensuring streams are validated before parameter recalculation. No known exploits are reported in the wild, and no CVSS score has been assigned yet. The vulnerability requires local code execution context where the attacker can trigger atomic mode setting operations, potentially via graphical session management or compositor interactions (e.g., sway window manager).

For European organizations, the impact of CVE-2024-47683 primarily concerns systems running Linux kernels with AMD GPU drivers, especially those using MST and DSC features for multi-display setups. This includes workstations, servers with graphical interfaces, and embedded systems relying on AMD GPUs. The vulnerability can lead to kernel crashes causing denial of service, disrupting critical operations, especially in environments where uptime and stability are essential such as financial institutions, research centers, and industrial control systems. While the vulnerability does not appear to allow privilege escalation or remote code execution directly, the resulting system instability can be exploited for targeted disruption or to facilitate further attacks by causing system reboots or service interruptions. Organizations using Linux-based desktops or servers with AMD GPUs in Europe may experience operational impacts, particularly if they use compositors or window managers that trigger atomic mode setting frequently. The lack of known exploits reduces immediate risk, but the vulnerability's presence in widely deployed Linux kernels means that patching is important to maintain system reliability and security posture.

1. Apply the latest Linux kernel updates that include the patch for CVE-2024-47683 as soon as they become available from your Linux distribution vendor. Monitor kernel mailing lists and vendor advisories for patch releases. 2. If immediate patching is not possible, consider disabling MST and DSC features in the AMD GPU driver configuration or kernel parameters to reduce exposure, if feasible without impacting critical functionality. 3. Limit access to systems with AMD GPUs to trusted users and processes to reduce the risk of local exploitation via malicious graphical session manipulation. 4. Monitor system logs for kernel oops or crashes related to drm_display_helper or amdgpu modules to detect potential triggering of this vulnerability. 5. For environments using compositors like sway or other Wayland/X11 window managers, ensure they are updated and configured securely to minimize unintended atomic mode setting operations. 6. Employ robust system monitoring and automated reboot prevention mechanisms to reduce downtime caused by kernel crashes. 7. Engage with hardware vendors and Linux distribution maintainers for guidance on best practices for AMD GPU driver security.