CVE-2024-50141

What it actually does

The flaw causes PRMT to incorrectly select an EFI_CONVENTIONAL_MEMORY block instead of one marked EFI_MEMORY_RUNTIME for PRM handler and context translation, resulting in a paging request exception during EFI runtime service invocation as defined in UEFI Section 2.2.2.

Why it matters to the business

Linux systems may encounter crashes or failures during ACPI PRM operations, impacting platform stability and runtime services in affected kernels; widespread kernel usage increases exposure across server and desktop fleets despite low EPSS.

How an attack unfolds

An attacker triggers PRM handler execution on a vulnerable kernel where the wrong memory type was allocated; the missing EFI_MEMORY_RUNTIME attribute leads to an unhandled paging fault in EFI runtime wrappers, potentially crashing the system or failing error handling paths. Context from 2024 zero-day campaigns by espionage and financially motivated actors as well as various Linux kernel out-of-bounds and uninitialized resource issues highlights potential interest in kernel memory flaws.

How to fix it

Upgrade the Linux kernel to the fixed commit 8df52929530839e878e6912e33348b54101e3250 available in the stable repository; rebuild and deploy updated kernels across affected distributions.

How to confirm the fix worked

Confirm the running kernel includes commit 8df52929530839e878e6912e33348b54101e3250; verify absence of the '[Firmware Bug]: Unable to handle paging request in EFI runtime service' warning and successful PRM handler mapping.

Typical attack path

1. Identify systems running vulnerable Linux kernel versions prior to the fix commit
2. Trigger conditions that invoke the ACPI PRM handler
3. Force use of improperly mapped EFI memory causing paging fault in runtime services
4. Observe exception handling failure or system instability

How to detect it

Search kernel logs and dmesg for EFI runtime service paging warnings and PRMT memory type messages; correlate with process activity invoking ACPI PRM handlers. Threat actor references to Linux kernel memory issues suggest monitoring for related exploitation patterns in zero-day campaigns.

What your security team should do

• Prioritize kernel updates to the referenced fixed commit within standard patch cycles given absence from KEV
• Review firmware and ACPI configurations for PRM compatibility on Linux deployments
• Monitor kernel logs for EFI runtime warnings as an interim detection measure