CVE-2024-49860 – This CVE-2024-49860 is a Linux kernel vulnerabi... (How to Fix)

Q: What is the severity of CVE-2024-49860?

CVE-2024-49860 has a CVSS score of 7.1 (HIGH). This CVE-2024-49860 is a Linux kernel vulnerability in the ACPI sysfs subsystem where improper validation of the _STR method's return type could lead to memory access violations. Attackers could potentially exploit this to cause kernel crashes or achieve local privilege escalation. All Linux systems using affected kernel versions are vulnerable.

📋 TL;DR

This CVE-2024-49860 is a Linux kernel vulnerability in the ACPI sysfs subsystem where improper validation of the _STR method's return type could lead to memory access violations. Attackers could potentially exploit this to cause kernel crashes or achieve local privilege escalation. All Linux systems using affected kernel versions are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE description; typically affects multiple stable kernel versions before the fix commits.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires ACPI subsystem to be enabled (common on most systems). The vulnerability is triggered when accessing ACPI sysfs entries that use the _STR method.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation leading to full system compromise, kernel panic causing system crashes, or information disclosure through memory access.

🟠

Likely Case

Kernel panic leading to denial of service (system crash/reboot) when malicious ACPI tables are loaded.

🟢

If Mitigated

System remains stable with proper kernel patches applied; unpatched systems risk crashes when accessing specific ACPI sysfs entries.

🌐 Internet-Facing: LOW - This requires local access to the system; cannot be exploited remotely over the network.

🏢 Internal Only: MEDIUM - Local users or processes could trigger the vulnerability, potentially leading to privilege escalation or denial of service.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to load or modify ACPI tables, or trigger specific sysfs operations. No public exploit code is known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 0cdfb9178a3bba843c95c2117c82c15f1a64b9ce, 2364b6af90c6b6d8a4783e0d3481ca80af699554, 4b081991c4363e072e1748efed0bbec8a77daba5, 4bb1e7d027413835b086aed35bc3f0713bc0f72b, 5c8d007c14aefc3f2ddf71e4c40713733dc827be

Vendor Advisory: https://git.kernel.org/stable/c/0cdfb9178a3bba843c95c2117c82c15f1a64b9ce

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Restrict ACPI sysfs access

linux

Limit access to ACPI sysfs entries to prevent triggering the vulnerability

chmod 600 /sys/firmware/acpi/*
chown root:root /sys/firmware/acpi/*

Disable ACPI sysfs if not needed

linux

Prevent loading of ACPI sysfs module if system doesn't require it

echo 'blacklist acpi' >> /etc/modprobe.d/blacklist.conf
update-initramfs -u

🧯 If You Can't Patch

Implement strict access controls to limit local user privileges
Monitor system logs for kernel panic events related to ACPI

🔍 How to Verify

Check if Vulnerable:

Check kernel version against distribution security advisories; examine if ACPI sysfs is accessible and system uses affected kernel commits

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits; test accessing ACPI sysfs entries to ensure no crashes occur

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/kern.log or dmesg
ACPI-related error messages or segmentation faults

Network Indicators:

None - this is a local vulnerability

SIEM Query:

source="kern.log" AND ("kernel panic" OR "segmentation fault") AND ("ACPI" OR "_STR")

📊 Metadata

CVE ID: CVE-2024-49860

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-843

Published: October 21, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-49860, you might also want to check these: