CVE-2025-24303: Intel 800 Series Ethernet Privilege Escalation

CVE-2025-24303 Overview

CVE-2025-24303 affects the Linux kernel-mode driver for Intel 800 Series Ethernet controllers before version 1.17.2. The driver fails to properly check for unusual or exceptional conditions [CWE-754], creating a privilege escalation path for local, authenticated users. An attacker with existing access to the system can leverage the flaw to gain elevated privileges on the host.

Critical Impact
Authenticated local users can escalate privileges through the Intel 800 Series Ethernet Linux kernel driver, compromising confidentiality, integrity, and availability of the affected system.

Affected Products

Intel 800 Series Ethernet Linux kernel-mode driver versions prior to 1.17.2
Systems running the vulnerable driver on Linux distributions
Server and workstation deployments using Intel 800 Series Ethernet network controllers

Discovery Timeline

2025-08-12 - CVE-2025-24303 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24303

Vulnerability Analysis

The vulnerability resides in the Linux kernel-mode driver supporting Intel 800 Series Ethernet controllers. The driver does not correctly validate unusual or exceptional conditions during execution, categorized under [CWE-754] Improper Check for Unusual or Exceptional Conditions. When a local authenticated user triggers these conditions through driver interactions, the kernel enters a state that permits privilege escalation.

The flaw executes in kernel context, which means successful exploitation grants attacker-controlled operations at the highest privilege level on the affected host. The exploitation path requires local access and valid credentials, and the attack complexity is high, requiring the attacker to reliably trigger the exceptional condition within the driver.

Root Cause

The root cause is missing or incomplete error handling in code paths that respond to unusual conditions inside the driver. When the kernel encounters an unexpected state without a corresponding safeguard, subsequent operations run against an inconsistent kernel state. This inconsistency provides the primitive an authenticated local user needs to escalate privileges.

Attack Vector

Exploitation requires local access and existing user-level credentials on the target Linux host. The attacker interacts with the vulnerable Intel 800 Series driver through standard user-accessible interfaces to trigger the exceptional condition. No user interaction from another party is required. Because the code runs in kernel space, successful exploitation impacts the entire operating system rather than a single user session.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. Refer to the Intel Security Advisory SA-01296 for vendor-provided technical detail.

Detection Methods for CVE-2025-24303

Indicators of Compromise

Unexpected kernel warnings, oops, or panics referencing the Intel 800 Series Ethernet driver in dmesg or /var/log/kern.log
Presence of driver binaries or modules with versions older than 1.17.2 loaded via lsmod or modinfo
Unexplained privilege changes for local user accounts following interaction with network driver interfaces

Detection Strategies

Inventory Linux hosts running Intel 800 Series Ethernet hardware and verify the loaded driver version against 1.17.2 or later.
Monitor kernel log streams for anomalous errors originating from the ice driver module or related network kernel subsystems.
Correlate local user activity with kernel-mode faults to identify attempted exploitation of exceptional-condition handling.

Monitoring Recommendations

Centralize kernel log collection and alert on repeated driver-level exceptions on hosts with the vulnerable driver.
Track process creation events under unexpected UIDs, particularly transitions from unprivileged users to root shortly after network driver interactions.
Baseline module load events and alert on driver reloads or unexpected version rollbacks on production systems.

How to Mitigate CVE-2025-24303

Immediate Actions Required

Identify all Linux systems running Intel 800 Series Ethernet controllers and confirm the installed driver version.
Upgrade the Intel 800 Series Ethernet Linux kernel-mode driver to version 1.17.2 or later on all affected hosts.
Restrict local access to affected systems until patching is complete, prioritizing multi-tenant and shared-user hosts.

Patch Information

Intel released a fixed driver in version 1.17.2. Apply the update as documented in the Intel Security Advisory SA-01296. Distribution-provided kernel packages may deliver the fix through backported updates, so verify the effective driver version after applying vendor kernel patches.

Workarounds

Limit interactive local logon rights on systems that cannot be immediately updated to reduce the pool of authenticated users capable of exploitation.
Enforce least privilege on accounts that access hosts equipped with Intel 800 Series Ethernet adapters.
Segment sensitive workloads onto systems whose driver version is confirmed at 1.17.2 or later.

bash

# Verify installed Intel 800 Series Ethernet (ice) driver version
modinfo ice | grep -E '^version:'

# Confirm the loaded module matches the fixed version (>= 1.17.2)
ethtool -i <interface> | grep -E 'driver|version'