In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: lantiq_etop: fix memory disclosure
When applying padding, the buffer is not zeroed, which results in memory disclosure. The mentioned data is observed on the wire. This patch uses skbputpadto() to pad Ethernet frames properly. The mentioned function zeroes the expanded buffer.
In case the packet cannot be padded it is silently dropped. Statistics are also not incremented. This driver does not support statistics in the old 32-bit format or the new 64-bit format. These will be added in the future. In its current form, the patch should be easily backported to stable versions.
Ethernet MACs on Amazon-SE and Danube cannot do padding of the packets in hardware, so software padding must be applied.
[
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/lantiq_etop.c",
"function": "ltq_etop_tx"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@185df159843d30fb71f821e7ea4368c2a3bfcd36",
"digest": {
"length": 1141.0,
"function_hash": "278606187952549522111422437963180367488"
},
"id": "CVE-2024-49997-123e982a"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/lantiq_etop.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45c0de18ff2dc9af01236380404bbd6a46502c69",
"digest": {
"line_hashes": [
"637265385071517276562697356462784146",
"57892081598248285204730885714145041890",
"11342075745322590303956222886444989166",
"37319376665197563849787118815446583610"
],
"threshold": 0.9
},
"id": "CVE-2024-49997-29e77099"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/lantiq_etop.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1097bf16501ed5e35358d848b0a94ad2830b0f65",
"digest": {
"line_hashes": [
"637265385071517276562697356462784146",
"57892081598248285204730885714145041890",
"11342075745322590303956222886444989166",
"37319376665197563849787118815446583610"
],
"threshold": 0.9
},
"id": "CVE-2024-49997-337bdd8c"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/lantiq_etop.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@185df159843d30fb71f821e7ea4368c2a3bfcd36",
"digest": {
"line_hashes": [
"637265385071517276562697356462784146",
"57892081598248285204730885714145041890",
"11342075745322590303956222886444989166",
"37319376665197563849787118815446583610"
],
"threshold": 0.9
},
"id": "CVE-2024-49997-503ab723"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/lantiq_etop.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60c068444c20bf9a3e22b65b5f6f3d9edc852931",
"digest": {
"line_hashes": [
"637265385071517276562697356462784146",
"57892081598248285204730885714145041890",
"11342075745322590303956222886444989166",
"37319376665197563849787118815446583610"
],
"threshold": 0.9
},
"id": "CVE-2024-49997-5203c0cf"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/lantiq_etop.c",
"function": "ltq_etop_tx"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@469856f76f4802c5d7e3d20e343185188de1e2db",
"digest": {
"length": 1141.0,
"function_hash": "278606187952549522111422437963180367488"
},
"id": "CVE-2024-49997-593147a1"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/lantiq_etop.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@905f06a34f960676e7dc77bea00f2f8fe18177ad",
"digest": {
"line_hashes": [
"637265385071517276562697356462784146",
"57892081598248285204730885714145041890",
"11342075745322590303956222886444989166",
"37319376665197563849787118815446583610"
],
"threshold": 0.9
},
"id": "CVE-2024-49997-5b465629"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/lantiq_etop.c",
"function": "ltq_etop_tx"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45c0de18ff2dc9af01236380404bbd6a46502c69",
"digest": {
"length": 1166.0,
"function_hash": "90165524020086758371815609163324805377"
},
"id": "CVE-2024-49997-60cf03d1"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/lantiq_etop.c",
"function": "ltq_etop_tx"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1097bf16501ed5e35358d848b0a94ad2830b0f65",
"digest": {
"length": 1166.0,
"function_hash": "90165524020086758371815609163324805377"
},
"id": "CVE-2024-49997-800d9eeb"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/lantiq_etop.c",
"function": "ltq_etop_tx"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bf4c101d7c99483b8b15a0c8f881e3f399f7e18",
"digest": {
"length": 1166.0,
"function_hash": "90165524020086758371815609163324805377"
},
"id": "CVE-2024-49997-8bd2546b"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/lantiq_etop.c",
"function": "ltq_etop_tx"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60c068444c20bf9a3e22b65b5f6f3d9edc852931",
"digest": {
"length": 1141.0,
"function_hash": "278606187952549522111422437963180367488"
},
"id": "CVE-2024-49997-c62a2582"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/lantiq_etop.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bf4c101d7c99483b8b15a0c8f881e3f399f7e18",
"digest": {
"line_hashes": [
"637265385071517276562697356462784146",
"57892081598248285204730885714145041890",
"11342075745322590303956222886444989166",
"37319376665197563849787118815446583610"
],
"threshold": 0.9
},
"id": "CVE-2024-49997-cc28990d"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/lantiq_etop.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@469856f76f4802c5d7e3d20e343185188de1e2db",
"digest": {
"line_hashes": [
"637265385071517276562697356462784146",
"57892081598248285204730885714145041890",
"11342075745322590303956222886444989166",
"37319376665197563849787118815446583610"
],
"threshold": 0.9
},
"id": "CVE-2024-49997-dd6ac646"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/lantiq_etop.c",
"function": "ltq_etop_tx"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@905f06a34f960676e7dc77bea00f2f8fe18177ad",
"digest": {
"length": 1123.0,
"function_hash": "102159351012961583000698335908853278264"
},
"id": "CVE-2024-49997-ea9cf3c3"
}
]