Junglewise Threat Intelligence

CVE-2024-47747: Linux Kernel use after free in ether3 network driver

CVE-2024-47747 · Severity: high · CVSS 7 · Published 2024-10-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's ether3 network driver that could lead to a system crash or unauthorized memory access. The issue occurs when a network device is removed while a background timer is still running, causing the system to attempt to use memory that has already been freed. This could potentially be exploited by a local user to disrupt system operations or gain elevated privileges.

Technical details

A use-after-free (UAF) vulnerability exists in the ether3 driver (drivers/net/ethernet/seeq/ether3.c) of the Linux kernel. The root cause is a race condition where the 'ether3_ledoff' timer callback may execute after the 'ether3_remove' function has already freed the 'net_device' structure. An attacker with local access could trigger this race by initiating device or module removal while the LED timer is active. If successful, the timer callback attempts to access the freed device structure via 'ether3_outw', leading to memory corruption or a kernel panic. The fix involves adding 'del_timer_sync' in the 'ether3_remove' cleanup path to ensure the timer is canceled before memory is deallocated.

Affected products

  • Linux Linux Kernel 4.15 to 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.54, 6.7 to 6.10.13, 6.11 to 6.11.2

Timeline

  • 2024-10-21: advisory: Initial publication of CVE-2024-47747
  • 2024-10-17: patched: Fix committed to stable kernel branches

References

Related threats