CVE-2024-40928

What it actually does

Null pointer dereference when ethtool_get_phy_stats_ethtool() calls a NULL ops->get_ethtool_phy_stats function pointer instead of returning -EOPNOTSUPP.

Why it matters to the business

Kernel instability or crashes during network interface statistics queries on affected Linux systems, potentially disrupting network management and requiring reboots.

How an attack unfolds

An attacker with local access issues an ethtool command that invokes get_phy_stats on a network device driver whose ops structure lacks the get_ethtool_phy_stats handler, triggering the null dereference.

How to fix it

Upgrade the Linux kernel to a version containing commit 25504f7fe60058b2a9553a9e424fb7dd9683843e or later stable releases that include the fix returning -EOPNOTSUPP for missing handlers.

How to confirm the fix worked

Verify the presence of the fix by inspecting net/ethtool/ioctl.c around line 2233 for the NULL check and -EOPNOTSUPP return, or confirm the running kernel is newer than the vulnerable commit.

Typical attack path

1. Obtain local shell or unprivileged access on a vulnerable Linux kernel
2. Identify network interfaces using ethtool -S or similar queries that reach ethtool_get_phy_stats_ethtool
3. Trigger the code path where ops->get_ethtool_phy_stats is NULL
4. Cause kernel null dereference leading to panic or oops

How to detect it

Search kernel logs and dmesg for oops or panic messages referencing ethtool, ioctl.c, or null function pointer dereference in phy stats handling.

• Called function pointer is null
• ethtool_get_phy_stats_ethtool
• net/ethtool/ioctl.c:2233

What your security team should do

• Apply the kernel patch containing commit 25504f7fe60058b2a9553a9e424fb7dd9683843e immediately on all exposed systems
• Prioritize updates for systems performing frequent ethtool operations or using custom network drivers
• Monitor kernel logs for null dereference oops in ethtool paths until patching is complete