CVE-2023-54037 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
ice: prevent NULL pointer deref during reload
Calling ethtool during reload can lead to call trace, because VSI isn't configured for some time, but netdev is alive.
To fix it add rtnl lock for VSI deconfig and config. Set ::num_q_vectors to 0 after freeing and add a check for ::tx/rx_rings in ring related ethtool ops.
Add proper unroll of filters in ice_start_eth().
Reproduction: $watch -n 0.1 -d 'ethtool -g enp24s0f0np0' $devlink dev reload pci/0000:18:00.0 action driver_reinit
Call trace before fix: [66303.926205] BUG: kernel NULL pointer dereference, address: 0000000000000000
[66303.926259] #PF: supervisor read access in kernel mode
[66303.926286] #PF: error_code(0x0000) - not-present page
[66303.926311] PGD 0 P4D 0
[66303.926332] Oops: 0000 [#1] PREEMPT SMP PTI
[66303.926358] CPU: 4 PID: 933821 Comm: ethtool Kdump: loaded Tainted: G OE 6.4.0-rc5+ #1
[66303.926400] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.00.01.0014.070920180847 07/09/2018
[66303.926446] RIP: 0010:ice_get_ringparam+0x22/0x50 [ice]
[66303.926649] Code: 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 8b 87 c0 09 00 00 c7 46 04 e0 1f 00 00 c7 46 10 e0 1f 00 00 48 8b 50 20 <48> 8b 12 0f b7 52 3a 89 56 14 48 8b 40 28 48 8b 00 0f b7 40 58 48
[66303.926722] RSP: 0018:ffffad40472f39c8 EFLAGS: 00010246
[66303.926749] RAX: ffff98a8ada05828 RBX: ffff98a8c46dd060 RCX: ffffad40472f3b48
[66303.926781] RDX: 0000000000000000 RSI: ffff98a8c46dd068 RDI: ffff98a8b23c4000
[66303.926811] RBP: ffffad40472f3b48 R08: 00000000000337b0 R09: 0000000000000000
[66303.926843] R10: 0000000000000001 R11: 0000000000000100 R12: ffff98a8b23c4000
[66303.926874] R13: ffff98a8c46dd060 R14: 000000000000000f R15: ffffad40472f3a50
[66303.926906] FS: 00007f6397966740(0000) GS:ffff98b390900000(0000) knlGS:0000000000000000
[66303.926941] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[66303.926967] CR2: 0000000000000000 CR3: 000000011ac20002 CR4: 00000000007706e0
[66303.926999] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[66303.927029] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[66303.927060] PKRU: 55555554
[66303.927075] Call Trace:
[66303.927094] <TASK>
[66303.927111] ? __die+0x23/0x70
[66303.927140] ? page_fault_oops+0x171/0x4e0
[66303.927176] ? exc_page_fault+0x7f/0x180
[66303.927209] ? asm_exc_page_fault+0x26/0x30
[66303.927244] ? ice_get_ringparam+0x22/0x50 [ice]
[66303.927433] rings_prepare_data+0x62/0x80
[66303.927469] ethnl_default_doit+0xe2/0x350
[66303.927501] genl_family_rcv_msg_doit.isra.0+0xe3/0x140
[66303.927538] genl_rcv_msg+0x1b1/0x2c0
[66303.927561] ? __pfx_ethnl_default_doit+0x10/0x10
[66303.927590] ? __pfx_genl_rcv_msg+0x10/0x10
[66303.927615] netlink_rcv_skb+0x58/0x110
[66303.927644] genl_rcv+0x28/0x40
[66303.927665] netlink_unicast+0x19e/0x290
[66303.927691] netlink_sendmsg+0x254/0x4d0
[66303.927717] sock_sendmsg+0x93/0xa0
[66303.927743] __sys_sendto+0x126/0x170
[66303.927780] __x64_sys_sendto+0x24/0x30
[66303.928593] do_syscall_64+0x5d/0x90
[66303.929370] ? __count_memcg_events+0x60/0xa0
[66303.930146] ? count_memcg_events.constprop.0+0x1a/0x30
[66303.930920] ? handle_mm_fault+0x9e/0x350
[66303.931688] ? do_user_addr_fault+0x258/0x740
[66303.932452] ? exc_page_fault+0x7f/0x180
[66303.933193] entry_SYSCALL_64_after_hwframe+0x72/0xdc
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 12/26/2025
The vulnerability CVE-2023-54037 affects the Linux kernel's ice driver, which manages Intel Ethernet network adapters. This issue stems from a race condition during device reload operations where ethtool commands can trigger a NULL pointer dereference. The problem occurs when the Virtual Switch Instance (VSI) is not yet fully configured while the network device (netdev) remains active, creating a temporal window where certain ethtool operations attempt to access uninitialized memory structures. The root cause lies in insufficient synchronization between the device deconfiguration and reconfiguration phases, particularly in how the driver handles ring parameters during reload operations.
The technical flaw manifests when ethtool queries ring parameters through the ice_get_ringparam function, which attempts to dereference a NULL pointer in the VSI structure. This occurs because the driver does not properly enforce serialization during the reload process, allowing concurrent access to partially initialized data structures. The call trace shows the kernel attempting to access memory address zero, which results in a kernel panic and system crash. This vulnerability directly maps to CWE-476, which addresses NULL pointer dereference issues in software systems, and aligns with ATT&CK technique T1490, specifically focusing on denial of service through kernel-level exploitation.
The operational impact of this vulnerability is significant, as it can cause system instability and complete system crashes when administrators or automated processes attempt to query network device parameters during or immediately after a device reload operation. The vulnerability is particularly dangerous in production environments where network management tools frequently interact with device drivers, as it can lead to unexpected service interruptions and potential data loss. Attackers could potentially exploit this to cause persistent denial of service conditions, especially in environments where automated reload operations are common.
The fix implemented addresses this vulnerability through multiple defensive mechanisms including the addition of rtnl lock enforcement during VSI deconfiguration and configuration phases, proper cleanup of the num_q_vectors field after memory deallocation, and validation checks for tx/rx rings in ring-related ethtool operations. The solution also includes proper filter unrolling in the ice_start_eth function to ensure complete cleanup of network filters during device reload. These mitigations align with industry best practices for kernel driver development and prevent race conditions by enforcing proper synchronization between concurrent operations. The fix ensures that ethtool operations during reload periods will not attempt to access uninitialized memory structures, thereby preventing the kernel NULL pointer dereference that previously caused system crashes.