PT-2024-32185 · Linux+7 · Linux Kernel+7
Published
2024-08-21
·
Updated
2026-05-26
·
CVE-2024-46770
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.52
Description
The issue arises when ethtool callbacks are executed while a reset is in progress, attempting to access deleted resources. This can result in a NULL pointer dereference. The reproduction steps involve triggering a reset and then trying to get coalesce settings using ethtool. The
ice get q coalesce function is specifically mentioned as being involved in the NULL pointer dereference. Technical details include the execution of ethtool callbacks during reset and the access of deleted resources, such as getting coalesce settings.Recommendations
To resolve the issue, update the Linux kernel to version 6.6.52 or later. As a temporary workaround, consider disabling ethtool operations during reset by calling
netif device detach() before reset and netif device attach() after reset is done and ice rebuild() is executing. Restrict access to the vulnerable ice get q coalesce function until a patch is available. Avoid using ethtool commands during reset to minimize the risk of exploitation.Exploit
Fix
DoS
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu