https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 13:55:12 +0000 https://vulnerability.circl.lu/vuln/cve-2024-47747 <p><strong>Affected:</strong> Linux, Siemens RUGGEDCOM RST2428P, Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family, Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition</p> <p>In the ether3_probe function, a timer is initialized with a callback function ether3_ledoff, bound to &amp;prev(dev)-&gt;timer. Once the timer is started, there is a risk of a race condition if the module or device is removed, triggering the ether3_remove function to perform cleanup. The sequence of operations that may lead to a UAF bug is as follows:</p> <p>CPU0 CPU1</p> <p>| ether3_ledoff ether3_remove | free_netdev(dev); | put_devic | kfree(dev); | | ether3_outw(priv(dev)-&gt;regs.config2 |= CFG2_CTRLO, REG_CONFIG2); | // use dev</p> <p>Fix it by ensuring that the timer is canceled before proceeding with the cleanup in ether3_remove.</p> <p><strong>Affected:</strong> Linux, Siemens RUGGEDCOM RST2428P, Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family, Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition</p> <p>In the ether3_probe function, a timer is initialized with a callback function ether3_ledoff, bound to &amp;prev(dev)-&gt;timer. Once the timer is started, there is a risk of a race condition if the module or device is removed, triggering the ether3_remove function to perform cleanup. The sequence of operations that may lead to a UAF bug is as follows:</p> <p>CPU0 CPU1</p> <p>| ether3_ledoff ether3_remove | free_netdev(dev); | put_devic | kfree(dev); | | ether3_outw(priv(dev)-&gt;regs.config2 |= CFG2_CTRLO, REG_CONFIG2); | // use dev</p> <p>Fix it by ensuring that the timer is canceled before proceeding with the cleanup in ether3_remove.</p> https://vulnerability.circl.lu/vuln/cve-2024-47747