CVE-2024-49962

What it actually does

Failed ACPI_ALLOCATE_ZEROED() call in acpi_db_convert_to_package() leaves elements NULL, causing subsequent NULL pointer dereference and memory corruption in the Linux kernel ACPICA subsystem.

Why it matters to the business

Kernel instability or crashes during ACPI debug operations can lead to system downtime and loss of availability on affected Linux systems; low exploitability and no known active campaigns reduce immediate risk despite high ecosystem prevalence of Linux kernels.

How an attack unfolds

An attacker with local access or ability to trigger ACPI debug paths invokes acpi_db_convert_to_package() under memory pressure so that ACPI_ALLOCATE_ZEROED() returns NULL; the missing NULL check then allows dereference of the uninitialized element, crashing the kernel or enabling further corruption. Listed threat actors have shown interest in similar Linux kernel memory issues but no confirmed exploitation of this specific flaw.

How to fix it

Apply the ACPICA fix from commit 4d4547cf13cca820ff7e0f859ba83e1a610b9fd0 or upgrade to a kernel containing the resolution. For Rocky Linux 8 deployments, update the listed packages to the exact fixed module versions provided (e.g., jackson-databind 2.10.0-1.module+el8.3.0+53+ea062990 and equivalents for all 25 affected packages).

How to confirm the fix worked

Confirm kernel source contains the NULL return check after ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package(); verify package versions match the supplied fixed module strings on Rocky Linux 8 systems; test ACPI debug paths under memory-constrained conditions.

Typical attack path

1. Gain local execution or trigger ACPI debug interface on target system
2. Induce allocation failure during acpi_db_convert_to_package() execution
3. Trigger NULL dereference via un-checked element access
4. Achieve kernel crash or attempt to leverage resulting corruption

How to detect it

Review kernel logs for NULL pointer dereference oops messages referencing acpi_db_convert_to_package(); correlate with ACPI debug activity or memory-pressure events; no confirmed threat-actor IOCs are available for this issue.

What your security team should do

• Prioritize kernel updates on systems exposing ACPI debug functionality
• Monitor EPSS trend (stable at 0.0025) and re-evaluate if new exploitation evidence appears
• Apply the exact fixed package versions listed for Rocky Linux 8 to close the exposure
• Harden memory allocation paths and enable kernel NULL dereference protections where available