{"id":"CVE-2024-47747","state":"PUBLISHED","title":"net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition\n\nIn the ether3_probe function, a timer is initialized with a callback\nfunction ether3_ledoff, bound to &prev(dev)->timer. Once the timer is\nstarted, there is a risk of a race condition if the module or device\nis removed, triggering the ether3_remove function to perform cleanup.\nThe sequence of operations that may lead to a UAF bug is as follows:\n\nCPU0                                    CPU1\n\n                      |  ether3_ledoff\nether3_remove         |\n  free_netdev(dev);   |\n  put_devic           |\n  kfree(dev);         |\n |  ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2);\n                      | // use dev\n\nFix it by ensuring that the timer is canceled before proceeding with\nthe cleanup in ether3_remove.","publishedAt":"2024-10-21T12:14:13.783Z","updatedAt":"2026-10-15T00:53:05.770Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"25d559ed2beec9b34045886100dac46d1ad92eba","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"b5a84b6c772564c8359a9a0fbaeb2a2944aa1ee9","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"338a0582b28e69460df03af50e938b86b4206353","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"822c7bb1f6f8b0331e8d1927151faf8db3b33afd","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"1c57d61a43293252ad732007c7070fdb112545fd","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"d2abc379071881798d20e2ac1d332ad855ae22f3","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"516dbc6d16637430808c39568cbb6b841d32b55b","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"77a77331cef0a219b8dd91361435eeef04cb741c","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"b5109b60ee4fcb2f2bb24f589575e10cc5283ad4","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/seeq/ether3.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.15","versionType":"semver"},{"version":"4.19.323","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.285","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.227","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.168","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.113","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.54","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10.13","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11.2","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/seeq/ether3.c"]}],"references":["https://git.kernel.org/stable/c/25d559ed2beec9b34045886100dac46d1ad92eba","https://git.kernel.org/stable/c/b5a84b6c772564c8359a9a0fbaeb2a2944aa1ee9","https://git.kernel.org/stable/c/338a0582b28e69460df03af50e938b86b4206353","https://git.kernel.org/stable/c/822c7bb1f6f8b0331e8d1927151faf8db3b33afd","https://git.kernel.org/stable/c/1c57d61a43293252ad732007c7070fdb112545fd","https://git.kernel.org/stable/c/d2abc379071881798d20e2ac1d332ad855ae22f3","https://git.kernel.org/stable/c/516dbc6d16637430808c39568cbb6b841d32b55b","https://git.kernel.org/stable/c/77a77331cef0a219b8dd91361435eeef04cb741c","https://git.kernel.org/stable/c/b5109b60ee4fcb2f2bb24f589575e10cc5283ad4","https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:56.516Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/47xxx/CVE-2024-47747.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-47747","state":"PUBLISHED","datePublished":"2024-10-21T12:14:13.783Z","dateUpdated":"2026-10-15T00:53:05.770Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-09-30T16:00:12.960Z"},"containers":{"cna":{"title":"net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition\n\nIn the ether3_probe function, a timer is initialized with a callback\nfunction ether3_ledoff, bound to &prev(dev)->timer. Once the timer is\nstarted, there is a risk of a race condition if the module or device\nis removed, triggering the ether3_remove function to perform cleanup.\nThe sequence of operations that may lead to a UAF bug is as follows:\n\nCPU0                                    CPU1\n\n                      |  ether3_ledoff\nether3_remove         |\n  free_netdev(dev);   |\n  put_devic           |\n  kfree(dev);         |\n |  ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2);\n                      | // use dev\n\nFix it by ensuring that the timer is canceled before proceeding with\nthe cleanup in ether3_remove."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"25d559ed2beec9b34045886100dac46d1ad92eba","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"b5a84b6c772564c8359a9a0fbaeb2a2944aa1ee9","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"338a0582b28e69460df03af50e938b86b4206353","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"822c7bb1f6f8b0331e8d1927151faf8db3b33afd","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"1c57d61a43293252ad732007c7070fdb112545fd","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"d2abc379071881798d20e2ac1d332ad855ae22f3","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"516dbc6d16637430808c39568cbb6b841d32b55b","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"77a77331cef0a219b8dd91361435eeef04cb741c","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","status":"affected","lessThan":"b5109b60ee4fcb2f2bb24f589575e10cc5283ad4","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/seeq/ether3.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.15","versionType":"semver"},{"version":"4.19.323","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.285","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.227","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.168","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.113","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.54","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10.13","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11.2","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/seeq/ether3.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/25d559ed2beec9b34045886100dac46d1ad92eba"},{"url":"https://git.kernel.org/stable/c/b5a84b6c772564c8359a9a0fbaeb2a2944aa1ee9"},{"url":"https://git.kernel.org/stable/c/338a0582b28e69460df03af50e938b86b4206353"},{"url":"https://git.kernel.org/stable/c/822c7bb1f6f8b0331e8d1927151faf8db3b33afd"},{"url":"https://git.kernel.org/stable/c/1c57d61a43293252ad732007c7070fdb112545fd"},{"url":"https://git.kernel.org/stable/c/d2abc379071881798d20e2ac1d332ad855ae22f3"},{"url":"https://git.kernel.org/stable/c/516dbc6d16637430808c39568cbb6b841d32b55b"},{"url":"https://git.kernel.org/stable/c/77a77331cef0a219b8dd91361435eeef04cb741c"},{"url":"https://git.kernel.org/stable/c/b5109b60ee4fcb2f2bb24f589575e10cc5283ad4"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The free side is a local operation (module unload or sysfs driver unbind on the ecard bus); Acorn podules are not runtime hot-pluggable, so there is no physical or remote path that triggers `ether3_remove()`. A remote peer can keep the LED timer armed via received frames, but local access is required to reach the vulnerable free.\nAC:L - The attacker controls both sides of the race — traffic on the interface arms the 20 ms LED timer, and `ether3_close()` never cancels it, so a pending timer at `free_netdev()` time is essentially deterministic rather than a tight window. Heap grooming to reallocate the freed netdev is likewise under attacker control.\nPR:L - An unprivileged local user can drive the TX/RX paths that arm the timer and can spray the kernel heap to reclaim the freed `alloc_etherdev()` chunk, matching this CNA's scoring of the identical timer-not-cancelled-in-remove bug class. No capability check gates the attacker-controlled half of the race.\nUI:N - No victim action is needed beyond the driver teardown itself; once the timer is pending, the use-after-free fires automatically from softirq context roughly 20 ms later with no user involvement.\nS:U - The corruption is confined to kernel slab memory and kernel control flow — the same security authority that contains the flaw. There is no hypervisor, IOMMU, or sandbox boundary crossed.\nC:H - The callback reads `private->dev`, `priv(dev)->seeq`, and `regs.config2` out of freed memory; once that allocation is reclaimed, the driver operates on attacker- or victim-controlled contents, and the read-modify-write of `config2` plus the pointer-derived MMIO access provide an information-disclosure channel. Kernel use-after-free is scored High.\nI:H - `regs.config2 |= CFG2_CTRLO` writes back into the freed object, and the subsequent `writew()` targets `priv(dev)->seeq + 0x80` — an address sourced from freed memory. Reclaiming the allocation turns this into a 16-bit write to an attacker-chosen kernel address from softirq context, a control-flow-hijack-capable primitive.\nA:H - Even without successful reclaim, `ether3_ledoff()` dereferences poisoned/freed pointers and performs an I/O write through a garbage `seeq` pointer, producing an unhandled fault in timer softirq context — a kernel oops or panic. The freed `timer_list` also leaves the timer subsystem traversing released memory."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:39:54.983Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"4.19.323"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"5.4.285"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"5.10.227"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"5.15.168"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.1.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.6.54"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.10.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.11.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.12"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-47747","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-10-21T12:58:25.330423Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-21T13:04:13.623Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T22:21:41.323Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V1.1.1","versionType":"custom"}]},{"vendor":"Siemens","product":"RUGGEDCOM RST2428P","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V3.2","versionType":"custom"}]},{"vendor":"Siemens","product":"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V3.2","versionType":"custom"}]},{"vendor":"Siemens","product":"SCALANCE XCM-/XRM-/XCH-/XRH-300 family","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V3.2","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-355557.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T00:53:05.770Z"},"x_adpType":"supplier"}]}}}