#VU98888 Use-after-free in Linux kernel - CVE-2024-47747

Vulnerability identifier: #VU98888

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-47747

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ether3_remove() function in drivers/net/ethernet/seeq/ether3.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/338a0582b28e69460df03af50e938b86b4206353
https://git.kernel.org/stable/c/822c7bb1f6f8b0331e8d1927151faf8db3b33afd
https://git.kernel.org/stable/c/1c57d61a43293252ad732007c7070fdb112545fd
https://git.kernel.org/stable/c/d2abc379071881798d20e2ac1d332ad855ae22f3
https://git.kernel.org/stable/c/516dbc6d16637430808c39568cbb6b841d32b55b
https://git.kernel.org/stable/c/77a77331cef0a219b8dd91361435eeef04cb741c
https://git.kernel.org/stable/c/b5109b60ee4fcb2f2bb24f589575e10cc5283ad4

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.