CVE-2024-46770 (GCVE-0-2024-46770)

Vulnerability from cvelistv5 – Published: 2024-09-18 07:12 – Updated: 2026-06-01 16:04
VLAI
Title
ice: Add netif_device_attach/detach into PF reset flow
Summary
In the Linux kernel, the following vulnerability has been resolved: ice: Add netif_device_attach/detach into PF reset flow Ethtool callbacks can be executed while reset is in progress and try to access deleted resources, e.g. getting coalesce settings can result in a NULL pointer dereference seen below. Reproduction steps: Once the driver is fully initialized, trigger reset: # echo 1 > /sys/class/net/<interface>/device/reset when reset is in progress try to get coalesce settings using ethtool: # ethtool -c <interface> BUG: kernel NULL pointer dereference, address: 0000000000000020 PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 11 PID: 19713 Comm: ethtool Tainted: G S 6.10.0-rc7+ #7 RIP: 0010:ice_get_q_coalesce+0x2e/0xa0 [ice] RSP: 0018:ffffbab1e9bcf6a8 EFLAGS: 00010206 RAX: 000000000000000c RBX: ffff94512305b028 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff9451c3f2e588 RDI: ffff9451c3f2e588 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: ffff9451c3f2e580 R11: 000000000000001f R12: ffff945121fa9000 R13: ffffbab1e9bcf760 R14: 0000000000000013 R15: ffffffff9e65dd40 FS: 00007faee5fbe740(0000) GS:ffff94546fd80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000020 CR3: 0000000106c2e005 CR4: 00000000001706f0 Call Trace: <TASK> ice_get_coalesce+0x17/0x30 [ice] coalesce_prepare_data+0x61/0x80 ethnl_default_doit+0xde/0x340 genl_family_rcv_msg_doit+0xf2/0x150 genl_rcv_msg+0x1b3/0x2c0 netlink_rcv_skb+0x5b/0x110 genl_rcv+0x28/0x40 netlink_unicast+0x19c/0x290 netlink_sendmsg+0x222/0x490 __sys_sendto+0x1df/0x1f0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x82/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7faee60d8e27 Calling netif_device_detach() before reset makes the net core not call the driver when ethtool command is issued, the attempt to execute an ethtool command during reset will result in the following message: netlink error: No such device instead of NULL pointer dereference. Once reset is done and ice_rebuild() is executing, the netif_device_attach() is called to allow for ethtool operations to occur again in a safe manner.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: fcea6f3da546b93050f3534aadea7bd96c1d7349 , < 721f27f489a47ed0d8690b73fc1f070c2eb180cf (git)
Affected: fcea6f3da546b93050f3534aadea7bd96c1d7349 , < 9e3ffb839249eca113062587659224f856fe14e5 (git)
Affected: fcea6f3da546b93050f3534aadea7bd96c1d7349 , < efe8effe138044a4747d1112ebb8c454d1663723 (git)
Affected: fcea6f3da546b93050f3534aadea7bd96c1d7349 , < 36486c9e8e01b84faaee47203eac0b7e9cc7fa4a (git)
Affected: fcea6f3da546b93050f3534aadea7bd96c1d7349 , < d11a67634227f9f9da51938af085fb41a733848f (git)
Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.110 , ≤ 6.1.* (semver)
Unaffected: 6.6.51 , ≤ 6.6.* (semver)
Unaffected: 6.10.10 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46770",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T14:40:57.539269Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T14:41:12.705Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:18:10.538Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "721f27f489a47ed0d8690b73fc1f070c2eb180cf",
              "status": "affected",
              "version": "fcea6f3da546b93050f3534aadea7bd96c1d7349",
              "versionType": "git"
            },
            {
              "lessThan": "9e3ffb839249eca113062587659224f856fe14e5",
              "status": "affected",
              "version": "fcea6f3da546b93050f3534aadea7bd96c1d7349",
              "versionType": "git"
            },
            {
              "lessThan": "efe8effe138044a4747d1112ebb8c454d1663723",
              "status": "affected",
              "version": "fcea6f3da546b93050f3534aadea7bd96c1d7349",
              "versionType": "git"
            },
            {
              "lessThan": "36486c9e8e01b84faaee47203eac0b7e9cc7fa4a",
              "status": "affected",
              "version": "fcea6f3da546b93050f3534aadea7bd96c1d7349",
              "versionType": "git"
            },
            {
              "lessThan": "d11a67634227f9f9da51938af085fb41a733848f",
              "status": "affected",
              "version": "fcea6f3da546b93050f3534aadea7bd96c1d7349",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.110",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.51",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.10",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Add netif_device_attach/detach into PF reset flow\n\nEthtool callbacks can be executed while reset is in progress and try to\naccess deleted resources, e.g. getting coalesce settings can result in a\nNULL pointer dereference seen below.\n\nReproduction steps:\nOnce the driver is fully initialized, trigger reset:\n\t# echo 1 \u003e /sys/class/net/\u003cinterface\u003e/device/reset\nwhen reset is in progress try to get coalesce settings using ethtool:\n\t# ethtool -c \u003cinterface\u003e\n\nBUG: kernel NULL pointer dereference, address: 0000000000000020\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] PREEMPT SMP PTI\nCPU: 11 PID: 19713 Comm: ethtool Tainted: G S                 6.10.0-rc7+ #7\nRIP: 0010:ice_get_q_coalesce+0x2e/0xa0 [ice]\nRSP: 0018:ffffbab1e9bcf6a8 EFLAGS: 00010206\nRAX: 000000000000000c RBX: ffff94512305b028 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffff9451c3f2e588 RDI: ffff9451c3f2e588\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: ffff9451c3f2e580 R11: 000000000000001f R12: ffff945121fa9000\nR13: ffffbab1e9bcf760 R14: 0000000000000013 R15: ffffffff9e65dd40\nFS:  00007faee5fbe740(0000) GS:ffff94546fd80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000020 CR3: 0000000106c2e005 CR4: 00000000001706f0\nCall Trace:\n\u003cTASK\u003e\nice_get_coalesce+0x17/0x30 [ice]\ncoalesce_prepare_data+0x61/0x80\nethnl_default_doit+0xde/0x340\ngenl_family_rcv_msg_doit+0xf2/0x150\ngenl_rcv_msg+0x1b3/0x2c0\nnetlink_rcv_skb+0x5b/0x110\ngenl_rcv+0x28/0x40\nnetlink_unicast+0x19c/0x290\nnetlink_sendmsg+0x222/0x490\n__sys_sendto+0x1df/0x1f0\n__x64_sys_sendto+0x24/0x30\ndo_syscall_64+0x82/0x160\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7faee60d8e27\n\nCalling netif_device_detach() before reset makes the net core not call\nthe driver when ethtool command is issued, the attempt to execute an\nethtool command during reset will result in the following message:\n\n    netlink error: No such device\n\ninstead of NULL pointer dereference. Once reset is done and\nice_rebuild() is executing, the netif_device_attach() is called to allow\nfor ethtool operations to occur again in a safe manner."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T16:04:40.539Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/721f27f489a47ed0d8690b73fc1f070c2eb180cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e3ffb839249eca113062587659224f856fe14e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/efe8effe138044a4747d1112ebb8c454d1663723"
        },
        {
          "url": "https://git.kernel.org/stable/c/36486c9e8e01b84faaee47203eac0b7e9cc7fa4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d11a67634227f9f9da51938af085fb41a733848f"
        }
      ],
      "title": "ice: Add netif_device_attach/detach into PF reset flow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46770",
    "datePublished": "2024-09-18T07:12:28.607Z",
    "dateReserved": "2024-09-11T15:12:18.274Z",
    "dateUpdated": "2026-06-01T16:04:40.539Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46770",
      "date": "2026-07-24",
      "epss": "0.0024",
      "percentile": "0.15175"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:13:29.000Z",
      "cve": "CVE-2024-46770",
      "id": "msrc_CVE-2024-46770",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "product_status:under_investigation": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ice: Add netif_device_attach/detach into PF reset flow",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-46770.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46770\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-18T08:15:04.957\",\"lastModified\":\"2026-06-17T07:55:53.833\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: Add netif_device_attach/detach into PF reset flow\\n\\nEthtool callbacks can be executed while reset is in progress and try to\\naccess deleted resources, e.g. getting coalesce settings can result in a\\nNULL pointer dereference seen below.\\n\\nReproduction steps:\\nOnce the driver is fully initialized, trigger reset:\\n\\t# echo 1 \u003e /sys/class/net/\u003cinterface\u003e/device/reset\\nwhen reset is in progress try to get coalesce settings using ethtool:\\n\\t# ethtool -c \u003cinterface\u003e\\n\\nBUG: kernel NULL pointer dereference, address: 0000000000000020\\nPGD 0 P4D 0\\nOops: Oops: 0000 [#1] PREEMPT SMP PTI\\nCPU: 11 PID: 19713 Comm: ethtool Tainted: G S                 6.10.0-rc7+ #7\\nRIP: 0010:ice_get_q_coalesce+0x2e/0xa0 [ice]\\nRSP: 0018:ffffbab1e9bcf6a8 EFLAGS: 00010206\\nRAX: 000000000000000c RBX: ffff94512305b028 RCX: 0000000000000000\\nRDX: 0000000000000000 RSI: ffff9451c3f2e588 RDI: ffff9451c3f2e588\\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\\nR10: ffff9451c3f2e580 R11: 000000000000001f R12: ffff945121fa9000\\nR13: ffffbab1e9bcf760 R14: 0000000000000013 R15: ffffffff9e65dd40\\nFS:  00007faee5fbe740(0000) GS:ffff94546fd80000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000000000000020 CR3: 0000000106c2e005 CR4: 00000000001706f0\\nCall Trace:\\n\u003cTASK\u003e\\nice_get_coalesce+0x17/0x30 [ice]\\ncoalesce_prepare_data+0x61/0x80\\nethnl_default_doit+0xde/0x340\\ngenl_family_rcv_msg_doit+0xf2/0x150\\ngenl_rcv_msg+0x1b3/0x2c0\\nnetlink_rcv_skb+0x5b/0x110\\ngenl_rcv+0x28/0x40\\nnetlink_unicast+0x19c/0x290\\nnetlink_sendmsg+0x222/0x490\\n__sys_sendto+0x1df/0x1f0\\n__x64_sys_sendto+0x24/0x30\\ndo_syscall_64+0x82/0x160\\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\\nRIP: 0033:0x7faee60d8e27\\n\\nCalling netif_device_detach() before reset makes the net core not call\\nthe driver when ethtool command is issued, the attempt to execute an\\nethtool command during reset will result in the following message:\\n\\n    netlink error: No such device\\n\\ninstead of NULL pointer dereference. Once reset is done and\\nice_rebuild() is executing, the netif_device_attach() is called to allow\\nfor ethtool operations to occur again in a safe manner.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: Agregar netif_device_attach/detach en el flujo de reinicio de PF Las devoluciones de llamadas de Ethtool se pueden ejecutar mientras el reinicio est\u00e1 en progreso e intentar acceder a los recursos eliminados, por ejemplo, obtener configuraciones de coalesce puede resultar en una desreferencia de puntero NULL que se ve a continuaci\u00f3n. Pasos de reproducci\u00f3n: Una vez que el controlador est\u00e9 completamente inicializado, active el reinicio: # echo 1 \u0026gt; /sys/class/net//device/reset cuando el reinicio est\u00e9 en progreso intente obtener la configuraci\u00f3n de coalesce usando ethtool: # ethtool -c  ERROR: desreferencia de puntero NULL del n\u00facleo, direcci\u00f3n: 0000000000000020 PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 11 PID: 19713 Comm: ethtool Tainted: GS 6.10.0-rc7+ #7 RIP: 0010:ice_get_q_coalesce+0x2e/0xa0 [ice] RSP: 0018:ffffbab1e9bcf6a8 EFLAGS: 00010206 RAX: 0000000000000000c RBX: ffff94512305b028 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff9451c3f2e588 RDI: ffff9451c3f2e588 RBP: 000000000000000 R08: 000000000000000 R09: 0000000000000000 R10: ffff9451c3f2e580 R11: 000000000000001f R12: ffff945121fa9000 R13: ffffbab1e9bcf760 R14: 0000000000000013 R15: ffffffff9e65dd40 FS: 00007faee5fbe740(0000) GS:ffff94546fd80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000080050033 CR2: 000000000000020 CR3: 0000000106c2e005 CR4: 00000000001706f0 Seguimiento de llamadas:  ice_get_coalesce+0x17/0x30 [ice] coalesce_prepare_data+0x61/0x80 ethnl_default_doit+0xde/0x340 genl_family_rcv_msg_doit+0xf2/0x150 genl_rcv_msg+0x1b3/0x2c0 netlink_rcv_skb+0x5b/0x110 genl_rcv+0x28/0x40 netlink_unicast+0x19c/0x290 netlink_sendmsg+0x222/0x490 __sys_sendto+0x1df/0x1f0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x82/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e DESCANSE EN P\u00c9RDIDA: 0033:0x7faee60d8e27 Llamar a netif_device_detach() antes del reinicio hace que el n\u00facleo de red no llame al controlador cuando se emite el comando ethtool, el intento de ejecutar un comando ethtool durante el reinicio dar\u00e1 como resultado el siguiente mensaje: error de netlink: No existe dicho dispositivo en lugar de la desreferencia de puntero NULL. Una vez que se realiza el reinicio y se ejecuta ice_rebuild(), se llama a netif_device_attach() para permitir que las operaciones de ethtool se realicen nuevamente de manera segura.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/intel/ice/ice_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fcea6f3da546b93050f3534aadea7bd96c1d7349\",\"lessThan\":\"721f27f489a47ed0d8690b73fc1f070c2eb180cf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fcea6f3da546b93050f3534aadea7bd96c1d7349\",\"lessThan\":\"9e3ffb839249eca113062587659224f856fe14e5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fcea6f3da546b93050f3534aadea7bd96c1d7349\",\"lessThan\":\"efe8effe138044a4747d1112ebb8c454d1663723\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fcea6f3da546b93050f3534aadea7bd96c1d7349\",\"lessThan\":\"36486c9e8e01b84faaee47203eac0b7e9cc7fa4a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fcea6f3da546b93050f3534aadea7bd96c1d7349\",\"lessThan\":\"d11a67634227f9f9da51938af085fb41a733848f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/intel/ice/ice_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.209\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.110\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.51\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.10\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T14:40:57.539269Z\",\"id\":\"CVE-2024-46770\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.17\",\"versionEndExcluding\":\"6.1.110\",\"matchCriteriaId\":\"B5B79244-509A-41A4-94DD-97D80A01AB5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.51\",\"matchCriteriaId\":\"E4529134-BAC4-4776-840B-304009E181A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.10\",\"matchCriteriaId\":\"ACDEE48C-137A-4731-90D0-A675865E1BED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/36486c9e8e01b84faaee47203eac0b7e9cc7fa4a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/721f27f489a47ed0d8690b73fc1f070c2eb180cf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9e3ffb839249eca113062587659224f856fe14e5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d11a67634227f9f9da51938af085fb41a733848f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/efe8effe138044a4747d1112ebb8c454d1663723\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:17:11+00:00",
      "cve": "CVE-2024-46770",
      "id": "CVE-2024-46770",
      "initial_release_date": "2024-09-18T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ice: Add netif_device_attach/detach into PF reset flow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46770.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:18:10.538Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46770\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T14:40:57.539269Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T14:41:02.011Z\"}}], \"cna\": {\"title\": \"ice: Add netif_device_attach/detach into PF reset flow\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"fcea6f3da546b93050f3534aadea7bd96c1d7349\", \"lessThan\": \"721f27f489a47ed0d8690b73fc1f070c2eb180cf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fcea6f3da546b93050f3534aadea7bd96c1d7349\", \"lessThan\": \"9e3ffb839249eca113062587659224f856fe14e5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fcea6f3da546b93050f3534aadea7bd96c1d7349\", \"lessThan\": \"efe8effe138044a4747d1112ebb8c454d1663723\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fcea6f3da546b93050f3534aadea7bd96c1d7349\", \"lessThan\": \"36486c9e8e01b84faaee47203eac0b7e9cc7fa4a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fcea6f3da546b93050f3534aadea7bd96c1d7349\", \"lessThan\": \"d11a67634227f9f9da51938af085fb41a733848f\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/intel/ice/ice_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.209\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.110\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.51\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/intel/ice/ice_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/721f27f489a47ed0d8690b73fc1f070c2eb180cf\"}, {\"url\": \"https://git.kernel.org/stable/c/9e3ffb839249eca113062587659224f856fe14e5\"}, {\"url\": \"https://git.kernel.org/stable/c/efe8effe138044a4747d1112ebb8c454d1663723\"}, {\"url\": \"https://git.kernel.org/stable/c/36486c9e8e01b84faaee47203eac0b7e9cc7fa4a\"}, {\"url\": \"https://git.kernel.org/stable/c/d11a67634227f9f9da51938af085fb41a733848f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: Add netif_device_attach/detach into PF reset flow\\n\\nEthtool callbacks can be executed while reset is in progress and try to\\naccess deleted resources, e.g. getting coalesce settings can result in a\\nNULL pointer dereference seen below.\\n\\nReproduction steps:\\nOnce the driver is fully initialized, trigger reset:\\n\\t# echo 1 \u003e /sys/class/net/\u003cinterface\u003e/device/reset\\nwhen reset is in progress try to get coalesce settings using ethtool:\\n\\t# ethtool -c \u003cinterface\u003e\\n\\nBUG: kernel NULL pointer dereference, address: 0000000000000020\\nPGD 0 P4D 0\\nOops: Oops: 0000 [#1] PREEMPT SMP PTI\\nCPU: 11 PID: 19713 Comm: ethtool Tainted: G S                 6.10.0-rc7+ #7\\nRIP: 0010:ice_get_q_coalesce+0x2e/0xa0 [ice]\\nRSP: 0018:ffffbab1e9bcf6a8 EFLAGS: 00010206\\nRAX: 000000000000000c RBX: ffff94512305b028 RCX: 0000000000000000\\nRDX: 0000000000000000 RSI: ffff9451c3f2e588 RDI: ffff9451c3f2e588\\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\\nR10: ffff9451c3f2e580 R11: 000000000000001f R12: ffff945121fa9000\\nR13: ffffbab1e9bcf760 R14: 0000000000000013 R15: ffffffff9e65dd40\\nFS:  00007faee5fbe740(0000) GS:ffff94546fd80000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000000000000020 CR3: 0000000106c2e005 CR4: 00000000001706f0\\nCall Trace:\\n\u003cTASK\u003e\\nice_get_coalesce+0x17/0x30 [ice]\\ncoalesce_prepare_data+0x61/0x80\\nethnl_default_doit+0xde/0x340\\ngenl_family_rcv_msg_doit+0xf2/0x150\\ngenl_rcv_msg+0x1b3/0x2c0\\nnetlink_rcv_skb+0x5b/0x110\\ngenl_rcv+0x28/0x40\\nnetlink_unicast+0x19c/0x290\\nnetlink_sendmsg+0x222/0x490\\n__sys_sendto+0x1df/0x1f0\\n__x64_sys_sendto+0x24/0x30\\ndo_syscall_64+0x82/0x160\\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\\nRIP: 0033:0x7faee60d8e27\\n\\nCalling netif_device_detach() before reset makes the net core not call\\nthe driver when ethtool command is issued, the attempt to execute an\\nethtool command during reset will result in the following message:\\n\\n    netlink error: No such device\\n\\ninstead of NULL pointer dereference. Once reset is done and\\nice_rebuild() is executing, the netif_device_attach() is called to allow\\nfor ethtool operations to occur again in a safe manner.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.209\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.110\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.51\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.10\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"4.17\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-06-01T16:04:40.539Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46770\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-01T16:04:40.539Z\", \"dateReserved\": \"2024-09-11T15:12:18.274Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-18T07:12:28.607Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.