CVE-2024-46822

5.5 · MEDIUM

Published Sep 27, 2024 linux CWE-476 EPSS 0.25% (16th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-46822 is a medium-severity vulnerability affecting linux linux_kernel. It was published on September 27, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry

In a review discussion of the changes to support vCPU hotplug where

a check was added on the GICC being enabled if was online, it was

noted that there is need to map back to the cpu and use that to index

into a cpumask. As such, a valid ID is needed.

If an MPIDR check fails in acpi_map_gic_cpu_interface() it is possible

for the entry in cpu_madt_gicc[cpu] == NULL. This function would

then cause a NULL pointer dereference. Whilst a path to trigger

this has not been established, harden this caller against the

possibility.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 0, < 5.4.284	Affected

References

Ref git.kernel.org/stable/c/2488444274c70038eb6b686cba5f1ce48ebb9cdd Ref git.kernel.org/stable/c/40cae0df42e5e7f7a1c0f32deed9c4027c1ba94e Ref git.kernel.org/stable/c/4c3b21204abb4fa3ab310fbbb5cf7f0e85f3a1bc Ref git.kernel.org/stable/c/62ca6d3a905b4c40cd942f3cc645a6718f8bc7e7 Ref git.kernel.org/stable/c/945be49f4e832a9184c313fdf8917475438a795b Ref git.kernel.org/stable/c/bc7fbb37e3d2df59336eadbd6a56be632e3c7df7 Ref git.kernel.org/stable/c/f57769ff6fa7f97f1296965f20e8a2bb3ee9fd0f Ref lists.debian.org/debian-lts-announce/2024/10/msg00003.html Ref lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Frequently Asked Questions

What is CVE-2024-46822?

CVE-2024-46822 is a medium-severity vulnerability affecting linux linux_kernel. It was published on September 27, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-46822?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-46822?

How can CyberStrike help with CVE-2024-46822?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-46822 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719