CVE-2024-46768

What it actually does

Missing NULL check on WMI event data in hp-wmi-sensors allows a NULL ACPI object to reach the notify handler, resulting in improper input validation that can trigger a kernel crash or undefined behavior.

Why it matters to the business

Systems running affected kernel versions may experience unexpected reboots or hangs when WMI events are delivered without data, leading to downtime on servers and workstations that rely on hp hardware monitoring.

How an attack unfolds

An attacker with the ability to trigger or simulate a WMI event lacking event data can cause the kernel to dereference a NULL pointer in the hp-wmi-sensors handler; no named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Update the Linux kernel to a version containing commit 217539e994e53206bbf3fb330261cc78c480d311 or later; for go-ethereum update to 1.9.20 or newer if that component is in use.

How to confirm the fix worked

Confirm the running kernel contains the fix commit or is newer than the listed fixed versions; test by generating a WMI event with no data and verifying the system remains stable.

Typical attack path

1. Obtain local access or the ability to influence WMI event delivery on an affected Linux system
2. Trigger a WMI event that returns a NULL ACPI object
3. Kernel notify handler processes the NULL without validation and crashes

How to detect it

Examine kernel logs for oops or panic entries referencing hp-wmi-sensors or NULL pointer dereferences around WMI notify handling; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates on all affected hp systems within standard patch windows
• Monitor vendor advisories for backported fixes in distribution kernels
• Review hardware monitoring configurations to reduce unnecessary WMI event exposure where possible