{"id":"CVE-2024-41046","state":"PUBLISHED","title":"net: ethernet: lantiq_etop: fix double free in detach","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: lantiq_etop: fix double free in detach\n\nThe number of the currently released descriptor is never incremented\nwhich results in the same skb being released multiple times.","publishedAt":"2024-07-29T14:32:03.686Z","updatedAt":"2026-10-15T00:47:23.179Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","status":"affected","lessThan":"1a2db00a554cfda57c397cce79b2804bf9633fec","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","status":"affected","lessThan":"907443174e76b854d28024bd079f0e53b94dc9a1","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","status":"affected","lessThan":"22b16618a80858b3a9d607708444426948cc4ae1","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","status":"affected","lessThan":"69ad5fa0ce7c548262e0770fc2b726fe7ab4f156","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","status":"affected","lessThan":"c2b66e2b3939af63699e4a4bd25a8ac4a9b1d1b3","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","status":"affected","lessThan":"9d23909ae041761cb2aa0c3cb1748598d8b6bc54","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","status":"affected","lessThan":"84aaaa796a19195fc59290154fef9aeb1fba964f","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","status":"affected","lessThan":"e1533b6319ab9c3a97dad314dd88b3783bc41b69","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/lantiq_etop.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.0","versionType":"semver"},{"version":"4.19.318","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.280","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.222","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.163","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.100","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.41","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.9.10","status":"unaffected","lessThanOrEqual":"6.9.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/lantiq_etop.c"]}],"references":["https://git.kernel.org/stable/c/1a2db00a554cfda57c397cce79b2804bf9633fec","https://git.kernel.org/stable/c/907443174e76b854d28024bd079f0e53b94dc9a1","https://git.kernel.org/stable/c/22b16618a80858b3a9d607708444426948cc4ae1","https://git.kernel.org/stable/c/69ad5fa0ce7c548262e0770fc2b726fe7ab4f156","https://git.kernel.org/stable/c/c2b66e2b3939af63699e4a4bd25a8ac4a9b1d1b3","https://git.kernel.org/stable/c/9d23909ae041761cb2aa0c3cb1748598d8b6bc54","https://git.kernel.org/stable/c/84aaaa796a19195fc59290154fef9aeb1fba964f","https://git.kernel.org/stable/c/e1533b6319ab9c3a97dad314dd88b3783bc41b69","https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-503939.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/41xxx/CVE-2024-41046.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-41046","state":"PUBLISHED","datePublished":"2024-07-29T14:32:03.686Z","dateUpdated":"2026-10-15T00:47:23.179Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-07-12T12:17:45.625Z"},"containers":{"cna":{"title":"net: ethernet: lantiq_etop: fix double free in detach","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: lantiq_etop: fix double free in detach\n\nThe number of the currently released descriptor is never incremented\nwhich results in the same skb being released multiple times."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","status":"affected","lessThan":"1a2db00a554cfda57c397cce79b2804bf9633fec","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","status":"affected","lessThan":"907443174e76b854d28024bd079f0e53b94dc9a1","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","status":"affected","lessThan":"22b16618a80858b3a9d607708444426948cc4ae1","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","status":"affected","lessThan":"69ad5fa0ce7c548262e0770fc2b726fe7ab4f156","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","status":"affected","lessThan":"c2b66e2b3939af63699e4a4bd25a8ac4a9b1d1b3","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","status":"affected","lessThan":"9d23909ae041761cb2aa0c3cb1748598d8b6bc54","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","status":"affected","lessThan":"84aaaa796a19195fc59290154fef9aeb1fba964f","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","status":"affected","lessThan":"e1533b6319ab9c3a97dad314dd88b3783bc41b69","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/lantiq_etop.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.0","versionType":"semver"},{"version":"4.19.318","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.280","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.222","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.163","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.100","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.41","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.9.10","status":"unaffected","lessThanOrEqual":"6.9.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/lantiq_etop.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/1a2db00a554cfda57c397cce79b2804bf9633fec"},{"url":"https://git.kernel.org/stable/c/907443174e76b854d28024bd079f0e53b94dc9a1"},{"url":"https://git.kernel.org/stable/c/22b16618a80858b3a9d607708444426948cc4ae1"},{"url":"https://git.kernel.org/stable/c/69ad5fa0ce7c548262e0770fc2b726fe7ab4f156"},{"url":"https://git.kernel.org/stable/c/c2b66e2b3939af63699e4a4bd25a8ac4a9b1d1b3"},{"url":"https://git.kernel.org/stable/c/9d23909ae041761cb2aa0c3cb1748598d8b6bc54"},{"url":"https://git.kernel.org/stable/c/84aaaa796a19195fc59290154fef9aeb1fba964f"},{"url":"https://git.kernel.org/stable/c/e1533b6319ab9c3a97dad314dd88b3783bc41b69"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The teardown path is reached via `ndo_tx_timeout`, which `dev_watchdog()` fires when the TX queue stays stopped for 10 s with carrier up — inducible by an attacker on the same Ethernet segment via sustained 802.3x PAUSE flooding or link-level stalling of the 100 Mbit MAC on these Lantiq CPE devices. The stall mechanism is link-local L2 and does not survive a router hop, so Adjacent rather than Network.\nAC:L - The attacker fully controls the stalling condition and can simply keep transmitting PAUSE frames past the 10-second watchdog window, and the buggy loop then unconditionally frees the same skb 192 times with no race or layout precondition. Heap grooming of the freed skb is also attacker-controlled since the same interface is receiving their traffic.\nPR:N - No account, credential, or authentication on the target is needed — an unauthenticated peer on the link segment only has to emit flow-control/traffic frames to trip the transmit watchdog. No local access or capability is involved on this path.\nUI:N - The watchdog timer fires automatically from `dev_watchdog()` and calls `ltq_etop_tx_timeout()` with no administrator or user action. No interface down/up, unbind, or module unload by a legitimate user is required.\nS:U - The double free corrupts kernel slab state within the same kernel security authority; no VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The 191 redundant frees operate on freed sk_buff memory, dereferencing `skb->head`/`skb->end` to reach `skb_shinfo()` and re-inserting the object into the skb slab freelist, producing overlapping allocations that let an attacker read reallocated kernel heap contents (other packets, credentials, kernel pointers). Per kernel guidance, use-after-free/double-free is scored High confidentiality.\nI:H - Freeing the same object 192 times corrupts the `skbuff_cache` freelist into aliased allocations (arbitrary write primitive) and drives an indirect call through the attacker-influenceable `skb->destructor` field in `skb_release_head_state()`, plus a controlled `skb->head` free and page refcount decrements. This is a control-flow-hijack-capable memory corruption, not a bounded modification.\nA:H - Even without exploitation the 191-fold double free reliably triggers slab corruption, list poisoning, and kernel panic/oops, and the DMA engine may still have the freed buffer mapped. The trigger is repeatable at will by the adjacent attacker."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:34:58.198Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"4.19.318"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"5.4.280"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"5.10.222"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"5.15.163"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"6.1.100"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"6.6.41"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"6.9.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"6.10"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/1a2db00a554cfda57c397cce79b2804bf9633fec","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/907443174e76b854d28024bd079f0e53b94dc9a1","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/22b16618a80858b3a9d607708444426948cc4ae1","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/69ad5fa0ce7c548262e0770fc2b726fe7ab4f156","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/c2b66e2b3939af63699e4a4bd25a8ac4a9b1d1b3","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/9d23909ae041761cb2aa0c3cb1748598d8b6bc54","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/84aaaa796a19195fc59290154fef9aeb1fba964f","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/e1533b6319ab9c3a97dad314dd88b3783bc41b69","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T21:59:45.501Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-41046","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T16:22:57.535074Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-11T17:34:02.313Z"}},{"affected":[{"vendor":"Siemens","product":"RUGGEDCOM RST2428P","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V3.1","versionType":"custom"}]},{"vendor":"Siemens","product":"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family","defaultStatus":"unknown","versions":[{"version":"0","status":"unaffected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SCALANCE XCM-/XRM-/XCH-/XRH-300 family","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V3.1","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - BIOS","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-503939.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-613116.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-355557.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T00:47:23.179Z"},"x_adpType":"supplier"}]}}}