CVE-2022-48690

What it actually does

The ice network driver leaks DMA mappings when RX ring parameters are changed via ethtool; kfree is called on rx_buf structures without unmapping the associated DMA addresses, and similar reallocation issues occur during XDP/BPF program load/unload and XSK pool creation.

Why it matters to the business

On systems using Intel E800-series NICs, repeated ring-size adjustments can gradually exhaust DMA and memory resources, leading to degraded network performance or eventual system instability; the issue affects many Linux distributions and cloud images that include the ice driver.

How an attack unfolds

An attacker with local shell access repeatedly invokes ethtool -G to alter RX/TX ring counts in a tight loop; each iteration triggers ice_vsi_cfg_rxq and ice_alloc_rx_buf without proper DMA unmap, accumulating leaked mappings until resource pressure appears.

How to fix it

Upgrade the Linux kernel to a version containing commit 07f40e9f0ff342eb3e97d5c544783b7cb641689c or later; rebuild and reboot with the patched ice driver; avoid frequent dynamic ring-size changes on unpatched systems.

How to confirm the fix worked

Confirm the running kernel contains commit 07f40e9f0ff342eb3e97d5c544783b7cb641689c; reproduce the ethtool loop while monitoring /proc/meminfo and DMA debug counters to verify no new leaks occur.

Typical attack path

1. Obtain local unprivileged or root shell on a host with an ice-driven NIC
2. Execute a loop that calls ethtool -G <iface> rx <size> tx <size> with varying sizes every few hundred milliseconds
3. Monitor for rising DMA or memory usage; repeat until denial-of-service or crash occurs

How to detect it

Search system logs and audit trails for repeated invocations of ethtool -G on ice interfaces; correlate with rising DMA allocation failures or slab leaks reported by kmemleak or dmesg.

• ethtool -G .* rx [0-9]+ tx [0-9]+
• ice_vsi_cfg_rxq.*kfree
• DMA mapping leak.*ice

What your security team should do

• Prioritize kernel updates on all hosts exposing ice NICs to the fixed commit
• Add ethtool ring-change frequency to anomaly detection rules
• Restrict ethtool access via sudoers or capabilities where ring tuning is unnecessary