CVE-2024-47747

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition

In the ether3_probe function, a timer is initialized with a callback

function ether3_ledoff, bound to &prev(dev)->timer. Once the timer is

started, there is a risk of a race condition if the module or device

is removed, triggering the ether3_remove function to perform cleanup.

The sequence of operations that may lead to a UAF bug is as follows:

CPU0 CPU1

| ether3_ledoff

ether3_remove |

free_netdev(dev); |

put_devic |

kfree(dev); |

| ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2);

| // use dev

Fix it by ensuring that the timer is canceled before proceeding with

the cleanup in ether3_remove.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References