CVE-2024-57920 is a vulnerability identified in the Linux kernel, specifically within the AMD GPU driver subsystem (amdkfd). The issue arises in the workqueue release function kfd_process_wq_release(), which is responsible for signaling a DMA fence used for synchronization of GPU memory eviction events. The vulnerability is due to the function dma_fence_signal() being called without verifying if the dma_fence pointer is NULL. This occurs because the eviction fence (kfd_process->ef) is initialized only after a specific ioctl call (kfd_process_device_init_vm()), meaning that a newly created kfd_process has a NULL eviction fence. If a kfd_process is closed immediately after opening, the dma_fence_signal() function is called with a NULL pointer, triggering a kernel warning and potentially causing instability or a kernel crash. The patch conditionally signals the eviction fence only when it is available, preventing the NULL pointer dereference. This vulnerability is a logic flaw in the driver’s handling of process lifecycle events and synchronization fences, leading to a potential denial of service (DoS) via kernel warnings or crashes. Although no known exploits are reported in the wild, the issue affects Linux kernel versions containing the affected commit hashes and impacts systems using AMD GPU drivers with the amdkfd module.

For European organizations, this vulnerability primarily poses a risk of local denial of service on Linux systems utilizing AMD GPUs, particularly in environments where GPU compute workloads are common, such as scientific research, media production, and cloud infrastructure providers. A kernel warning or crash could disrupt critical services, cause system instability, or require reboots, impacting availability. Confidentiality and integrity impacts are minimal since the flaw is a NULL pointer dereference rather than a privilege escalation or code execution vulnerability. However, in multi-tenant or shared environments, repeated triggering could be used to degrade service reliability. Organizations relying on Linux servers with AMD GPUs for compute tasks or graphical workloads should be aware of this issue. The vulnerability does not require remote exploitation or user interaction but does require the ability to open and close kfd_processes, which may be limited to local users or processes with specific privileges. Thus, the threat is more significant in environments where untrusted users have local access or where automated processes might inadvertently trigger the flaw.

To mitigate CVE-2024-57920, European organizations should: 1) Apply the latest Linux kernel updates that include the patch fixing the conditional signaling of the eviction fence in the amdkfd driver. 2) Restrict local user access to systems with AMD GPUs to trusted personnel only, minimizing the risk of accidental or malicious triggering of the vulnerability. 3) Monitor kernel logs for warnings related to dma_fence_signal or amdkfd workqueue releases, which could indicate attempts to trigger the flaw. 4) In environments where kernel updates are delayed, consider disabling or unloading the amdkfd module if GPU compute workloads are not required, to reduce attack surface. 5) For critical systems, implement kernel live patching solutions if available to apply the fix without downtime. 6) Review and harden access controls around ioctl calls related to kfd_process_device_init_vm to prevent unauthorized manipulation of GPU process lifecycles.