{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-47747","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-09-30T16:00:12.960Z","datePublished":"2024-10-21T12:14:13.783Z","dateUpdated":"2026-08-05T11:39:54.983Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:39:54.983Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition\n\nIn the ether3_probe function, a timer is initialized with a callback\nfunction ether3_ledoff, bound to &prev(dev)->timer. Once the timer is\nstarted, there is a risk of a race condition if the module or device\nis removed, triggering the ether3_remove function to perform cleanup.\nThe sequence of operations that may lead to a UAF bug is as follows:\n\nCPU0                                    CPU1\n\n                      |  ether3_ledoff\nether3_remove         |\n  free_netdev(dev);   |\n  put_devic           |\n  kfree(dev);         |\n |  ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2);\n                      | // use dev\n\nFix it by ensuring that the timer is canceled before proceeding with\nthe cleanup in ether3_remove."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The free side is a local operation (module unload or sysfs driver unbind on the ecard bus); Acorn podules are not runtime hot-pluggable, so there is no physical or remote path that triggers `ether3_remove()`. A remote peer can keep the LED timer armed via received frames, but local access is required to reach the vulnerable free.\nAC:L - The attacker controls both sides of the race — traffic on the interface arms the 20 ms LED timer, and `ether3_close()` never cancels it, so a pending timer at `free_netdev()` time is essentially deterministic rather than a tight window. Heap grooming to reallocate the freed netdev is likewise under attacker control.\nPR:L - An unprivileged local user can drive the TX/RX paths that arm the timer and can spray the kernel heap to reclaim the freed `alloc_etherdev()` chunk, matching this CNA's scoring of the identical timer-not-cancelled-in-remove bug class. No capability check gates the attacker-controlled half of the race.\nUI:N - No victim action is needed beyond the driver teardown itself; once the timer is pending, the use-after-free fires automatically from softirq context roughly 20 ms later with no user involvement.\nS:U - The corruption is confined to kernel slab memory and kernel control flow — the same security authority that contains the flaw. There is no hypervisor, IOMMU, or sandbox boundary crossed.\nC:H - The callback reads `private->dev`, `priv(dev)->seeq`, and `regs.config2` out of freed memory; once that allocation is reclaimed, the driver operates on attacker- or victim-controlled contents, and the read-modify-write of `config2` plus the pointer-derived MMIO access provide an information-disclosure channel. Kernel use-after-free is scored High.\nI:H - `regs.config2 |= CFG2_CTRLO` writes back into the freed object, and the subsequent `writew()` targets `priv(dev)->seeq + 0x80` — an address sourced from freed memory. Reclaiming the allocation turns this into a 16-bit write to an attacker-chosen kernel address from softirq context, a control-flow-hijack-capable primitive.\nA:H - Even without successful reclaim, `ether3_ledoff()` dereferences poisoned/freed pointers and performs an I/O write through a garbage `seeq` pointer, producing an unhandled fault in timer softirq context — a kernel oops or panic. The freed `timer_list` also leaves the timer subsystem traversing released memory."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/seeq/ether3.c"],"versions":[{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","lessThan":"25d559ed2beec9b34045886100dac46d1ad92eba","status":"affected","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","lessThan":"b5a84b6c772564c8359a9a0fbaeb2a2944aa1ee9","status":"affected","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","lessThan":"338a0582b28e69460df03af50e938b86b4206353","status":"affected","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","lessThan":"822c7bb1f6f8b0331e8d1927151faf8db3b33afd","status":"affected","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","lessThan":"1c57d61a43293252ad732007c7070fdb112545fd","status":"affected","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","lessThan":"d2abc379071881798d20e2ac1d332ad855ae22f3","status":"affected","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","lessThan":"516dbc6d16637430808c39568cbb6b841d32b55b","status":"affected","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","lessThan":"77a77331cef0a219b8dd91361435eeef04cb741c","status":"affected","versionType":"git"},{"version":"6fd9c53f71862a4797b7ed8a5de80e2c64829f56","lessThan":"b5109b60ee4fcb2f2bb24f589575e10cc5283ad4","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/seeq/ether3.c"],"versions":[{"version":"4.15","status":"affected"},{"version":"0","lessThan":"4.15","status":"unaffected","versionType":"semver"},{"version":"4.19.323","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.285","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.227","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.168","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.113","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.54","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.10.13","lessThanOrEqual":"6.10.*","status":"unaffected","versionType":"semver"},{"version":"6.11.2","lessThanOrEqual":"6.11.*","status":"unaffected","versionType":"semver"},{"version":"6.12","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"4.19.323"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"5.4.285"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"5.10.227"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"5.15.168"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.1.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.6.54"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.10.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.11.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.12"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/25d559ed2beec9b34045886100dac46d1ad92eba"},{"url":"https://git.kernel.org/stable/c/b5a84b6c772564c8359a9a0fbaeb2a2944aa1ee9"},{"url":"https://git.kernel.org/stable/c/338a0582b28e69460df03af50e938b86b4206353"},{"url":"https://git.kernel.org/stable/c/822c7bb1f6f8b0331e8d1927151faf8db3b33afd"},{"url":"https://git.kernel.org/stable/c/1c57d61a43293252ad732007c7070fdb112545fd"},{"url":"https://git.kernel.org/stable/c/d2abc379071881798d20e2ac1d332ad855ae22f3"},{"url":"https://git.kernel.org/stable/c/516dbc6d16637430808c39568cbb6b841d32b55b"},{"url":"https://git.kernel.org/stable/c/77a77331cef0a219b8dd91361435eeef04cb741c"},{"url":"https://git.kernel.org/stable/c/b5109b60ee4fcb2f2bb24f589575e10cc5283ad4"}],"title":"net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-47747","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-10-21T12:58:25.330423Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-10-21T13:04:13.623Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T22:21:41.323Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-05-12T11:58:50.849Z"},"affected":[{"vendor":"Siemens","product":"RUGGEDCOM RST2428P","versions":[{"status":"affected","version":"0","lessThan":"V3.2","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family","versions":[{"status":"affected","version":"0","lessThan":"V3.2","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XCM-/XRM-/XCH-/XRH-300 family","versions":[{"status":"affected","version":"0","lessThan":"V3.2","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","versions":[{"status":"affected","version":"0","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-355557.html"}]}]}}