CVE-2024-24856

What it actually does

Unchecked return value from ACPI_ALLOCATE_ZEROED allows direct dereference of a potentially null pointer, resulting in a null pointer dereference.

Why it matters to the business

Local denial of service through system crashes or instability on affected systems, with low likelihood of remote or unauthenticated exploitation.

How an attack unfolds

An attacker with local low-privileged access and user interaction must trigger specific conditions that cause the allocation to fail, after which the null pointer is dereferenced to induce a crash.

How to fix it

Upgrade aws-efs-csi-driver-fips-1.6 (Chainguard) to version 1.6.0-r5 or later; add an explicit null check after the allocation and return AE_NO_MEMORY on failure.

How to confirm the fix worked

Confirm the installed package version meets or exceeds the fixed release; statically review allocation sites for subsequent null checks; test under memory pressure to verify graceful error handling.

Typical attack path

1. Gain local access to a system running the affected component
2. Arrange conditions that cause ACPI_ALLOCATE_ZEROED to return null
3. Trigger the code path that dereferences the unchecked pointer
4. Observe resulting kernel or process crash

How to detect it

Inspect kernel or driver logs for null pointer dereference faults originating from ACPI allocation paths; correlate with low-memory or high-contention events.

What your security team should do

• Apply the vendor-supplied update to the fixed version at the earliest maintenance window
• Review local attack surface and reduce unnecessary local access where feasible
• Monitor system logs for ACPI-related null dereference faults during routine operations