CVE-2024-47747: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
In the Linux kernel, the following vulnerability has been resolved:
net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
In the ether3probe function, a timer is initialized with a callback function ether3ledoff, bound to &prev(dev)->timer. Once the timer is started, there is a risk of a race condition if the module or device is removed, triggering the ether3remove function to perform cleanup. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| ether3ledoff ether3remove | freenetdev(dev); | putdevic | kfree(dev); | | ether3outw(priv(dev)->regs.config2 |= CFG2CTRLO, REGCONFIG2); | // use dev
Fix it by ensuring that the timer is canceled before proceeding with the cleanup in ether3remove.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Compensating control
If you are using a vulnerable ether3 module/kernel, mitigate the described use-after-free race by ensuring the timer referenced by &prev(dev)->timer is canceled before cleanup in ether3_remove.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47747?
CVE-2024-47747 is classified as having a high severity due to its potential impact on system integrity.
How do I fix CVE-2024-47747?
To fix CVE-2024-47747, update your Linux kernel to a version that is not affected, specifically any version starting from 6.1.123-1.
Which Linux kernel versions are affected by CVE-2024-47747?
CVE-2024-47747 affects Linux kernel versions from 4.15 up to 5.15 and several versions in between up to 6.11.
What is the nature of the vulnerability in CVE-2024-47747?
CVE-2024-47747 is a use-after-free vulnerability in the ether3 driver, caused by a race condition.
Can CVE-2024-47747 allow for remote exploitation?
Yes, CVE-2024-47747 can potentially be exploited remotely under certain conditions, making it critical to apply patches promptly.