Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2024-46679ethtool: check device is present when getting link settings

Description

In the Linux kernel, the following vulnerability has been resolved: ethtool: check device is present when getting link settings A sysfs reader can race with a device reset or removal, attempting to read device state when the device is not actually present. eg: [exception RIP: qed_get_current_link+17] #8 [ffffb9e4f2907c48] qede_get_link_ksettings at ffffffffc07a994a [qede] #9 [ffffb9e4f2907cd8] __rh_call_get_link_ksettings at ffffffff992b01a3 #10 [ffffb9e4f2907d38] __ethtool_get_link_ksettings at ffffffff992b04e4 #11 [ffffb9e4f2907d90] duplex_show at ffffffff99260300 #12 [ffffb9e4f2907e38] dev_attr_show at ffffffff9905a01c #13 [ffffb9e4f2907e50] sysfs_kf_seq_show at ffffffff98e0145b #14 [ffffb9e4f2907e68] seq_read at ffffffff98d902e3 #15 [ffffb9e4f2907ec8] vfs_read at ffffffff98d657d1 #16 [ffffb9e4f2907f00] ksys_read at ffffffff98d65c3f #17 [ffffb9e4f2907f38] do_syscall_64 at ffffffff98a052fb crash> struct net_device.state ffff9a9d21336000 state = 5, state 5 is __LINK_STATE_START (0b1) and __LINK_STATE_NOCARRIER (0b100). The device is not present, note lack of __LINK_STATE_PRESENT (0b10). This is the same sort of panic as observed in commit 4224cfd7fb65 ("net-sysfs: add check for netdevice being present to speed_show"). There are many other callers of __ethtool_get_link_ksettings() which don't have a device presence check. Move this check into ethtool to protect all callers.

Timeline

  1. ID reserved

    By Linux

  2. · 2 days later

    Published

  3. · 2 years later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-46679, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.1Medium4.7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS (exploitation in 30 days)
0.25% · top 84% of all CVEs (13 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.7.

Affected products

  • Linux · Linux

    • affected d519e17e2d01a0ee9abe083019532061b4438065 – < ec7b4f7f644018ac293cb1b02528a40a32917e62
    • affected d519e17e2d01a0ee9abe083019532061b4438065 – < 842a40c7273ba1c1cb30dda50405b328de1d860e
    • affected d519e17e2d01a0ee9abe083019532061b4438065 – < 7a8d98b6d6484d3ad358510366022da080c37cbc
    • affected d519e17e2d01a0ee9abe083019532061b4438065 – < 9bba5955eed160102114d4cc00c3d399be9bdae4
    • affected d519e17e2d01a0ee9abe083019532061b4438065 – < 94ab317024ba373d37340893d1c0358638935fbb
    • affected d519e17e2d01a0ee9abe083019532061b4438065 – < 1d6d9b5b1b95bfeccb84386a51b7e6c510ec13b2
    • affected d519e17e2d01a0ee9abe083019532061b4438065 – < a699781c79ecf6cfe67fb00a0331b4088c7c8466

  • Linux · Linux

    • affected 2.6.33
    • unaffected < 2.6.33
    • unaffected 5.4.283 – ≤ 5.4.*
    • unaffected 5.10.225 – ≤ 5.10.*
    • unaffected 5.15.166 – ≤ 5.15.*
    • unaffected 6.1.108 – ≤ 6.1.*
    • unaffected 6.6.49 – ≤ 6.6.*
    • unaffected 6.10.8 – ≤ 6.10.*
    • unaffected 6.11 – ≤ *

References

References12

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-46679 badge
[![CVE-2024-46679](https://cveledger.app/badge/CVE-2024-46679.svg)](https://cveledger.app/cve/CVE-2024-46679)

Record last updated .