CVE-2024-50221 is a high-severity vulnerability in the Linux kernel's AMD GPU driver, specifically affecting the 'drm/amd/pm' module for the Vangogh GPU architecture. The root cause is a kernel memory out-of-bounds write due to an insufficiently sized GPU metrics table allocated in the function vangogh_tables_init(). The vulnerability occurs because the table is allocated with 152 bytes, but a subsequent memset operation in smu_cmn_init_soft_gpu_metrics() writes 168 bytes, leading to a buffer overflow. This flaw was detected by Kernel Address Sanitizer (KASAN), which reported slab-out-of-bounds writes during GPU metrics initialization. The out-of-bounds write can corrupt kernel memory, potentially leading to system instability, crashes, or escalation of privileges. The vulnerability is classified under CWE-787 (Out-of-bounds Write). The fix applied is a brute-force increase in the allocation size to accommodate the larger memset operation, with plans for a more refined solution in the future. The vulnerability requires local privileges (low privilege required) but no user interaction, and it affects Linux kernel versions containing the vulnerable AMDGPU driver code for Vangogh GPUs. The CVSS 3.1 score is 7.8 (high), reflecting high impact on confidentiality, integrity, and availability due to the potential for kernel memory corruption and privilege escalation. No known exploits are currently reported in the wild.

For European organizations, this vulnerability poses a significant risk particularly to systems running Linux kernels with AMD Vangogh GPUs, which are common in workstations, servers, and embedded devices. Exploitation could allow local attackers or malicious applications to corrupt kernel memory, potentially leading to privilege escalation, unauthorized access to sensitive data, or denial of service through system crashes. This is especially critical for organizations relying on Linux-based infrastructure for critical operations, including government agencies, financial institutions, and technology companies. The vulnerability could also affect cloud service providers and data centers in Europe that use AMD GPUs for compute workloads, potentially impacting multi-tenant environments. Given the requirement for local access, the threat is higher in environments where users have shell access or where untrusted code execution is possible. The absence of known exploits reduces immediate risk but patching is urgent to prevent future exploitation.

European organizations should promptly apply the Linux kernel patches that address CVE-2024-50221 once available from their Linux distribution vendors. Until patches are deployed, organizations should restrict local access to systems with AMD Vangogh GPUs, enforce strict user privilege separation, and monitor for unusual kernel errors or crashes indicative of exploitation attempts. Security teams should audit systems to identify vulnerable kernel versions and affected hardware. Employing kernel hardening techniques such as Kernel Address Space Layout Randomization (KASLR), and enabling kernel lockdown features can reduce exploitation likelihood. Additionally, organizations should review and limit software that can execute with local privileges, especially untrusted or third-party applications. For cloud environments, isolate GPU-enabled instances and monitor for anomalous behavior. Coordination with Linux distribution maintainers to receive timely updates is critical. Finally, organizations should incorporate this vulnerability into their vulnerability management and incident response plans.