CVE-2024-46679

What it actually does

Race condition in ethtool link settings retrieval allows sysfs reads to access device state after reset or removal, triggering kernel panic via NULL or absent device dereference in drivers like qede.

Why it matters to the business

Unexpected kernel crashes on Linux systems during normal network device management operations cause unplanned downtime and service disruption; widespread Linux kernel usage amplifies operational risk across servers and embedded devices.

How an attack unfolds

An attacker or automated process triggers concurrent sysfs reads of link settings while a device reset or removal occurs; absence of presence check leads to panic in __ethtool_get_link_ksettings callers, as demonstrated in prior similar issues and referenced in 2024 exploitation campaigns by espionage and financially motivated actors.

How to fix it

Update Linux kernel to commit ec7b4f7f644018ac293cb1b02528a40a32917e62 or later stable releases containing the ethtool presence check; apply vendor backports where available.

How to confirm the fix worked

Confirm kernel source contains the ethtool device-present check before __ethtool_get_link_ksettings; verify no panics occur under concurrent sysfs reads during device removal in test environments.

Typical attack path

1. Identify systems exposing network device sysfs attributes
2. Race sysfs read of link settings (e.g., duplex_show) with device reset/removal
3. Trigger device state change to remove __LINK_STATE_PRESENT while state shows START+NOCARRIER
4. Cause kernel panic in driver function such as qed_get_current_link

How to detect it

Search kernel logs and crash dumps for RIP references to qed_get_current_link, __rh_call_get_link_ksettings, or duplex_show combined with net_device.state lacking __LINK_STATE_PRESENT; review threat actor reports of 2024 Linux kernel exploitation for matching panic signatures.

• exception RIP: qed_get_current_link+17
• state = 5
• __LINK_STATE_START and __LINK_STATE_NOCARRIER without __LINK_STATE_PRESENT
• qede_get_link_ksettings
• __ethtool_get_link_ksettings

What your security team should do

• Prioritize kernel upgrades on all production Linux systems within CISA-style timelines due to crash impact
• Monitor for related kernel oops/panic reports involving ethtool and qede functions
• Test device hotplug and reset scenarios after patching to validate stability
• Review downstream dependents of the affected kernel tree for coordinated updates