CVE-2024-47747

What it actually does

Use-after-free due to race condition between ether3_ledoff timer callback and device removal cleanup in the ether3 network driver, where the callback accesses a freed netdev structure after free_netdev and kfree.

Why it matters to the business

Local attackers may trigger kernel crashes or arbitrary code execution with elevated privileges on affected Linux systems; the issue is old but still relevant for unpatched kernels in embedded or legacy network hardware.

How an attack unfolds

An attacker with local access initiates module or device removal while the timer is scheduled, allowing the pending ether3_ledoff callback to dereference and use memory that has already been freed during cleanup.

How to fix it

Update the Linux kernel to a version containing the fix that cancels the timer before free_netdev in ether3_remove; rebuild and deploy the patched kernel on affected systems.

How to confirm the fix worked

Inspect the ether3_remove function in the kernel source to confirm timer deletion occurs prior to cleanup, and test module load/unload sequences under concurrent timer activity.

Typical attack path

1. Obtain local access on a system using the ether3 driver
2. Trigger concurrent module unload or device removal while the timer remains active
3. Cause the timer callback to execute and access the freed device structure

How to detect it

Review kernel logs and crash dumps for oops messages referencing ether3_ledoff, use-after-free in net/ethernet/seeq, or races during module removal.

What your security team should do

• Apply the timer-cancel fix to all Linux kernels using the ether3 driver
• Restrict local unprivileged access on systems with legacy network hardware
• Monitor kernel logs for use-after-free crashes involving ether3