CVE-2024-46770

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ice: Add netif_device_attach/detach into PF reset flow

Ethtool callbacks can be executed while reset is in progress and try to

access deleted resources, e.g. getting coalesce settings can result in a

NULL pointer dereference seen below.

Reproduction steps:

Once the driver is fully initialized, trigger reset:

# echo 1 > /sys/class/net/<interface>/device/reset

when reset is in progress try to get coalesce settings using ethtool:

# ethtool -c <interface>

BUG: kernel NULL pointer dereference, address: 0000000000000020

PGD 0 P4D 0

Oops: Oops: 0000 [#1] PREEMPT SMP PTI

CPU: 11 PID: 19713 Comm: ethtool Tainted: G S 6.10.0-rc7+ #7

RIP: 0010:ice_get_q_coalesce+0x2e/0xa0 [ice]

RSP: 0018:ffffbab1e9bcf6a8 EFLAGS: 00010206

RAX: 000000000000000c RBX: ffff94512305b028 RCX: 0000000000000000

RDX: 0000000000000000 RSI: ffff9451c3f2e588 RDI: ffff9451c3f2e588

RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References