CVE-2022-48841

What it actually does

NULL pointer dereference in ice_update_vsi_tx_ring_stats() when a Tx ring pointer is invalid; stats propagation code dereferences the pointer without a prior validity check, resulting in a kernel crash.

Why it matters to the business

Local users or processes can trigger denial of service via kernel panic on systems using the Intel ice network driver, interrupting network-dependent workloads until reboot.

How an attack unfolds

An attacker with local code execution obtains a handle that causes the ice driver to encounter a NULL Tx ring during statistics collection; the flawed stats update routine then dereferences the pointer and crashes the kernel.

How to fix it

Apply the upstream fix present in commit 2397270ec97c5e3009a58ac110a25e1869e9d6ff or later; update to a kernel release that contains this commit for the affected stable trees.

How to confirm the fix worked

Confirm the running kernel contains commit 2397270ec97c5e3009a58ac110a25e1869e9d6ff or verify that ice_update_vsi_tx_ring_stats() now skips NULL rings before propagating stats.

Typical attack path

1. Obtain local user or container access on a Linux host using the ice driver
2. Trigger network interface activity or driver statistics collection that reaches ice_update_vsi_tx_ring_stats() with a NULL ring pointer
3. Cause kernel oops/panic via the NULL dereference

How to detect it

Search kernel logs (dmesg, journalctl, /var/log/kern.log) for oops or panic messages containing ice_update_vsi_tx_ring_stats or NULL pointer dereference in the ice module; correlate with network interface statistics collection events.

• ice_update_vsi_tx_ring_stats
• NULL pointer dereference.*ice
• Call Trace:.*ice_update_vsi_tx_ring_stats

What your security team should do

• Prioritize patching kernel packages on all systems using the Intel ice driver
• Restrict untrusted local code execution until patches are deployed
• Monitor for kernel oops reports referencing the ice driver