CVE-2024-46834

What it actually does

Missing validation of maximum channel IDs in ethtool indirection tables when table fetch or memory allocation fails allows out-of-bounds channel references in RSS contexts, leading to kernel crashes.

Why it matters to the business

Rare network configuration changes can trigger system instability or denial of service on affected Linux systems, with low likelihood but potential operational disruption in high-availability network environments.

How an attack unfolds

An attacker triggers rare failure paths during ethtool channel reconfiguration (such as memory pressure or driver fetch errors) to bypass max-channel bounds checks, allowing invalid RSS indirection table entries that cause crashes when referenced.

How to fix it

Update the Linux kernel to commit 101737d8b88dbd4be6010bac398fe810f1950036 or later stable versions that enforce fail-closed behavior on max channel retrieval errors.

How to confirm the fix worked

Verify the applied kernel patch includes the fail-closed check in ethtool indirection table handling; test channel reduction operations under simulated fetch/allocation failure conditions to confirm no out-of-bounds entries are accepted.

Typical attack path

1. Identify target system running vulnerable Linux kernel with ethtool RSS support
2. Induce resource pressure or driver conditions that cause indirection table fetch or allocation to fail
3. Issue ethtool command to reduce ring count or alter channels while RSS contexts are active
4. Trigger use of out-of-bounds channel ID from the unvalidated table to crash the kernel

How to detect it

Review kernel logs for crashes or warnings during ethtool RSS or channel changes; inspect audit trails for ethtool invocations under memory pressure; correlate with driver-specific fetch failures.

What your security team should do

• Prioritize kernel upgrades on systems using bnxt or similar drivers with dynamic RSS contexts
• Monitor for unusual ethtool or network interface configuration events coinciding with system crashes
• Apply the fix in all production environments before relying on ring count reductions under load