CVE-2024-46770

What it actually does

Race condition in the Linux kernel ice Ethernet driver allows ethtool callbacks to execute during PF reset, resulting in NULL pointer dereference when accessing resources that have been deleted.

Why it matters to the business

Local users can trigger kernel crashes on systems using affected Intel network hardware, leading to denial of service and potential operational disruption; prevalence in Linux distributions increases exposure for servers and embedded devices.

How an attack unfolds

An attacker with local access triggers a device reset via sysfs while concurrently issuing an ethtool command such as retrieving coalesce settings, causing the driver to dereference freed memory instead of safely returning an error.

How to fix it

Update the Linux kernel to a version containing commit 9e3ffb839249eca113062587659224f856fe14e5 which adds netif_device_detach before reset and netif_device_attach after ice_rebuild completes.

How to confirm the fix worked

Confirm presence of the fix commit in the running kernel source, reproduce the reset-plus-ethtool sequence and verify the kernel returns 'No such device' netlink error instead of oops, or inspect dmesg for absence of ice_get_q_coalesce NULL dereference traces.

Typical attack path

1. Obtain local user access on a Linux system using the ice driver
2. Write 1 to /sys/class/net/<interface>/device/reset to initiate PF reset
3. Simultaneously execute ethtool -c <interface> or similar ethtool operations
4. Trigger NULL pointer dereference in ice_get_q_coalesce leading to kernel oops

How to detect it

Search kernel logs for 'BUG: kernel NULL pointer dereference' combined with 'ice_get_q_coalesce' or 'ice_get_coalesce' in the call trace; look for concurrent sysfs reset writes and ethtool invocations in process accounting or audit logs.

• ice_get_q_coalesce+0x2e/0xa0 [ice]
• BUG: kernel NULL pointer dereference, address: 0000000000000020
• RIP: 0010:ice_get_q_coalesce
• netif_device_detach
• netif_device_attach
• echo 1 > /sys/class/net/*/device/reset

What your security team should do

• Prioritize kernel upgrades containing the referenced commit on all systems using the ice driver
• Restrict local unprivileged access to ethtool and sysfs reset interfaces where feasible
• Monitor for kernel oops reports matching the described stack trace
• Test the reset-plus-ethtool scenario in staging environments before broad deployment