ACPI NULL Dereference Vulnerability in Linux Kernel - CVE-2024-56782
Summary
CVE-2024-56782: In the Linux kernel, the following vulnerability has been resolved: ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration() acpi_dev_hid_match() does not check for adev == NULL, dereferencing it unconditio... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its stability, performance, and support for a wide range of hardware architectures. The kernel manages system resources and facilitates communication between hardware and software components. However, vulnerabilities can arise, such as CVE-2024-56782, which affects the ACPI subsystem, potentially leading to system instability.
Vulnerability Detail
CVE-2024-56782 is a vulnerability in the Linux kernel's ACPI subsystem, specifically in the function acpi_quirk_skip_serdev_enumeration(). The issue arises because the function does not check if the acpi_device pointer (adev) is NULL before dereferencing it. This oversight could lead to a NULL pointer dereference, causing a system crash or instability. Although the function is not currently called with a controller_parent lacking an ACPI companion, the lack of a NULL check poses a risk that could be exploited in future scenarios.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate any potential risks.
Conclusion
CVE-2024-56782 is a significant vulnerability in the Linux kernel that poses risks of system instability due to a NULL pointer dereference. It is essential for users to update their systems to the patched version to mitigate these risks. Regular monitoring and updates are vital for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2024-56782 is a vulnerability in the Linux kernel's ACPI subsystem that can lead to a NULL pointer dereference.
If exploited, this vulnerability could cause system crashes or instability, particularly in systems relying on ACPI for hardware management.
The vulnerability affects Linux versions in Debian 11, 12, and 13. It is important to check your specific version and apply updates.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds, it is crucial to monitor for updates and apply them as soon as possible to protect your system.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
