CVE-2024-49860

What it actually does

The flaw permits the ACPI _STR method to return non-buffer objects, causing description_show() to dereference invalid memory.

Why it matters to the business

May cause kernel instability or crashes on affected Linux systems; low likelihood of widespread exploitation reduces immediate operational risk.

How an attack unfolds

An attacker supplies an ACPI table where _STR returns a non-buffer object; when userspace reads the corresponding sysfs attribute, description_show() performs an invalid memory access that can lead to denial of service.

How to fix it

Apply the kernel fix present in commit 92fd5209fc014405f63a7db79802ca4b01dc0c05; rebuild and deploy updated kernel packages across all affected distributions.

How to confirm the fix worked

Confirm kernel source contains the type check for buffer return from _STR before calling description_show(); test with ACPI tables returning non-buffer objects.

Typical attack path

1. Gain local access or ability to load malicious ACPI tables on target system
2. Trigger sysfs read of the _STR-derived attribute
3. Induce invalid memory access resulting in kernel fault

How to detect it

Inspect kernel logs for oops or panic messages originating from ACPI sysfs code paths; correlate with recent ACPI table loads or firmware updates.

What your security team should do

• Prioritize kernel updates on all production Linux hosts
• Include the fix in standard patching cycles given the stable low EPSS
• Monitor kernel logs for ACPI-related faults as an interim detection measure