CVE-2024-56782

What it actually does

Missing NULL check before calling acpi_dev_hid_match() allows unconditional dereference of adev, resulting in a NULL pointer dereference that can trigger memory corruption or a kernel crash.

Why it matters to the business

Unexpected system instability or crashes on affected Ubuntu 14.04 systems may interrupt workloads and require unplanned restarts until the package is updated.

How an attack unfolds

An attacker would need to trigger the acpi_quirk_skip_serdev_enumeration() path with a controller_parent lacking an ACPI companion so that adev becomes NULL and the subsequent unconditional dereference occurs, though the code path is not currently reachable without additional conditions.

How to fix it

Upgrade oxide-qt on Ubuntu 14.04 LTS to version 1.18.3-0ubuntu0.14.04.1 or later. Apply the update through standard package management and reboot if required by the kernel component.

How to confirm the fix worked

Verify the installed oxide-qt package version matches or exceeds 1.18.3-0ubuntu0.14.04.1 and confirm the source patch adding the adev NULL check is present in the running kernel.

Typical attack path

1. Identify a system running the vulnerable oxide-qt package on Ubuntu 14.04
2. Arrange for acpi_quirk_skip_serdev_enumeration() to be invoked without an ACPI companion device
3. Trigger the missing NULL guard inside acpi_dev_hid_match() to cause dereference
4. Observe resulting kernel panic or memory corruption

How to detect it

Review kernel logs for ACPI or serdev enumeration errors and unexpected NULL pointer dereference panics on systems running the affected package.

What your security team should do

• Prioritize patching oxide-qt on all Ubuntu 14.04 systems to the fixed version
• Monitor kernel logs for NULL dereference or ACPI-related panics until remediation is complete
• Plan migration off Ubuntu 14.04 LTS given its end-of-life status