PT-2024-32107 · Linux+8 · Linux Kernel+8
Published
2024-08-26
·
Updated
2026-02-21
·
CVE-2024-46679
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A sysfs reader can race with a device reset or removal, attempting to read device state when the device is not actually present. This issue is related to the
ethtool functionality, specifically when getting link settings. The problem arises because many callers of ethtool get link ksettings() do not check for device presence. To address this, a check has been moved into ethtool to protect all callers. The issue can lead to a panic, as observed in a previous commit related to adding a check for netdevice presence in speed show. Technical details include the involvement of functions such as qed get current link, qede get link ksettings, rh call get link ksettings, and ethtool get link ksettings, indicating a complex interaction within the kernel's networking components.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu