CVE-2024-24856: 
Linux Debian vulnerability analysis and mitigation

CVE-2024-24856 is a vulnerability in the ACPI (Advanced Configuration and Power Interface) system where the memory allocation function ACPI_ALLOCATE_ZEROED does not guarantee a successful allocation. The vulnerability was discovered and disclosed in April 2024, affecting various Linux kernel versions and distributions (NVD, Ubuntu).

The vulnerability stems from a null pointer dereference issue where the ACPI_ALLOCATE_ZEROED function's return value is not properly checked before being dereferenced in subsequent code. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H, indicating local access requirements and high availability impact (NVD).

If exploited, this vulnerability could lead to a null pointer dereference, potentially causing system crashes or denial of service conditions. The impact is primarily focused on system availability, with no direct impact on confidentiality or integrity (NVD).

The vulnerability requires local access with low privileges and user interaction. The high attack complexity suggests that exploitation is not straightforward and requires specific conditions to be met (NVD).

The fix involves adding a null pointer check after the ACPI_ALLOCATE_ZEROED allocation and returning an exception code AE_NO_MEMORY if the allocation fails. Various Linux distributions have released patches, including Ubuntu which has fixed the issue in multiple kernel versions including 5.15.0-83.92 for 22.04 LTS and 5.4.0-162.179 for 20.04 LTS (Ubuntu, OpenAnolis).