CVE-2022-49605 addresses a vulnerability in the Linux kernel's igc network driver, which handles Intel Gigabit Ethernet controllers. The issue stems from improper handling of PCIe bus errors, specifically PCIe link flaps, which can cause memory-mapped I/O (MMIO) reads to return 0xffffffff. Originally, the igc driver included logic (IGC_REMOVED checks) to detect such error states and avoid further MMIO accesses that could lead to system instability. However, this protective logic was removed in a subsequent commit under the assumption that it was only relevant for virtualization scenarios, which igc does not support. This assumption is flawed because PCIe devices can experience link flaps or detachments even outside virtualization contexts. Without the IGC_REMOVED checks, the driver fails to properly handle these error conditions, leading to NULL pointer dereferences when the hardware address pointer (hw->hw_addr) is set to NULL after detecting an error. Subsequent MMIO accesses then dereference this NULL pointer, causing kernel oops (crashes) and potential denial of service. The patch reinstates the IGC_REMOVED logic, implementing it similarly to the igb driver by checking if the hardware address pointer is NULL before performing MMIO reads or writes. This fix prevents kernel crashes triggered by PCIe link flaps on affected igc adapters by safely handling error states and avoiding invalid memory accesses. The vulnerability affects Linux kernel versions containing the specified commit 146740f9abc4 and related versions where the IGC_REMOVED logic was removed. No known exploits are reported in the wild as of the publication date. No CVSS score is assigned yet.

For European organizations, this vulnerability poses a risk primarily to systems running Linux kernels with the affected igc driver versions and using Intel Gigabit Ethernet controllers supported by this driver. The impact is mainly on system stability and availability, as kernel crashes (oops) can cause network outages, service disruptions, and potential data loss if critical systems reboot unexpectedly. This can affect data centers, enterprise servers, and network infrastructure devices relying on these network adapters. In environments with high PCIe traffic or unstable hardware conditions, the likelihood of PCIe link flaps increases, exacerbating the risk. Although this vulnerability does not directly lead to privilege escalation or data confidentiality breaches, the resulting denial of service can disrupt business operations, especially in sectors like finance, telecommunications, and critical infrastructure prevalent in Europe. Additionally, recovery from kernel crashes may require manual intervention, increasing operational costs and downtime. Since the vulnerability arises from hardware error conditions, it may also complicate troubleshooting and incident response. The absence of known exploits reduces immediate threat level but does not eliminate risk, particularly in large-scale deployments where hardware faults are more common.

European organizations should apply the Linux kernel patches that reinstate the IGC_REMOVED logic in the igc driver as soon as they become available. Specifically, updating to kernel versions that include the fix or backporting the patch to in-use kernel versions is essential. Network administrators should monitor kernel logs for signs of PCIe link flaps or igc driver oops to detect potential exploitation or hardware issues early. Implementing hardware health monitoring and ensuring PCIe devices and cables are in good condition can reduce the frequency of link flaps. For critical systems, consider deploying redundant network interfaces or failover mechanisms to maintain availability during transient hardware errors. Additionally, organizations should review their virtualization environments to confirm that similar checks are in place for other drivers, even if igc is not used in virtualization. Finally, maintain up-to-date Linux kernel versions and subscribe to vendor security advisories to promptly address similar vulnerabilities.