CVE-2024-42107

What it actually does

Race condition between ice_ptp_extts_event() and ice_ptp_release() allows a NULL ptp_clock pointer to be passed to ptp_clock_event(), resulting in a kernel panic via NULL pointer dereference.

Why it matters to the business

Systems using affected Intel Ethernet controllers experience unexpected kernel crashes and reboots when PTP timestamping is disabled while external events are pending, causing service interruptions and potential data loss.

How an attack unfolds

An attacker with local access triggers rapid enable/disable of PTP or external timestamp interrupts on an ice device; the interrupt handler runs after the PTP clock has been released, dereferencing NULL and crashing the kernel.

How to fix it

Update the Linux kernel to a version containing commit 1c4e524811918600683b1ea87a5e0fc2db64fa9b or later; rebuild and reboot with the patched ice driver.

How to confirm the fix worked

Verify the running kernel contains commit 1c4e524811918600683b1ea87a5e0fc2db64fa9b; confirm ice_ptp_extts_event() now checks PTP state before calling ptp_clock_event().

Typical attack path

1. Obtain local access to a system with an affected ice Ethernet device
2. Enable PTP and external timestamping
3. Trigger ice_ptp_release() while an extts interrupt is pending or racing
4. Kernel panics on NULL dereference in ptp_clock_event()

How to detect it

Search kernel logs for oops or panic messages containing ice_ptp_extts_event, ptp_clock_event, and NULL pointer dereference around the time of PTP disable operations.

• ice_ptp_extts_event
• ptp_clock_event
• NULL pointer dereference
• ice_ptp_release

What your security team should do

• Apply the referenced kernel commit immediately on all systems using ice devices with PTP
• Monitor for kernel oops involving ice_ptp and ptp_clock_event
• Disable PTP external timestamping on ice interfaces where not required until patched