[BUG] Possible Use-After-Free Vulnerability in ether3 Driver Due to Race Condition

["Wentai Deng" <wtdeng24@m.fudan.edu.cn>]

Our team recently developed a vulnerability detection tool, and we have employed it to scan the Linux Kernel (version 6.9.6). After manual review, we found some potentially vulnerable code snippets which may have use-after-free bugs due to race conditions. Therefore, we would appreciate your expert insight to confirm whether these vulnerabilities could indeed pose a risk to the system.

Vulnerability Description:

File: /drivers/net/ethernet/seeq/ether3.c

In the ether3_probe function, a timer is initialized with a callback function ether3_ledoff, bound to &prev(dev)->timer. Once the timer is started, there is a risk of a race condition if the module or device is removed, triggering the ether3_remove function to perform cleanup. The sequence of operations that may lead to a UAF bug is as follows:

CPU0                            CPU1

                            |   ether3_ledoff
ether3_remove               |
    free_netdev(dev);       |
    put_device              |
    kfree(dev);             |
                            |       ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2);
                            |       // use dev

Proposed Fix:

The issue can be resolved by ensuring that the timer is canceled before proceeding with the cleanup in ether3_remove or ether3_close. This will prevent any pending or active timer functions from accessing memory that has already been freed.

Relevant CVE and Reference:

This issue is similar to the vulnerability documented in CVE-2023-3141, and a related fix was implemented as shown in the following commit:

memstick: r592: Fix UAF bug in r592_remove due to race condition (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=63264422785021704c39b38f65a78ab9e4a186d7)

Request for Review:

We would appreciate your expert insight to confirm whether this vulnerability indeed poses a risk to the system and if the proposed fix is appropriate.

Thank you for your time and consideration.

Best regards,
Wentai Deng
wtdeng24@m.fudan.edu.cn