Skip to content
Heist/ feed
Unrated

net: ethernet: lantiq_etop: fix memory disclosure

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix memory disclosure When applying padding, the buffer is not zeroed, which results in memory disclosure. The mentioned data is observed on the wire. This patch uses skb_put_padto() to pad Ethernet frames properly. The mentioned function zeroes the expanded buffer. In case the packet cannot be padded it is silently dropped. Statistics are also not incremented. This driver does not support statistics in the old 32-bit format or the new 64-bit format. These will be added in the future. In its current form, the patch should be easily backported to stable versions. Ethernet MACs on Amazon-SE and Danube cannot do padding of the packets in hardware, so software padding must be applied.

Announced Group revision 1
Original source ↗

CVE-2024-49997

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2024-49997

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "504d4721ee8e432af4b5f196a08af38bc4dac5fe",
        "lessThan": "905f06a34f960676e7dc77bea00f2f8fe18177ad",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "504d4721ee8e432af4b5f196a08af38bc4dac5fe",
        "lessThan": "60c068444c20bf9a3e22b65b5f6f3d9edc852931",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "504d4721ee8e432af4b5f196a08af38bc4dac5fe",
        "lessThan": "185df159843d30fb71f821e7ea4368c2a3bfcd36",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "504d4721ee8e432af4b5f196a08af38bc4dac5fe",
        "lessThan": "469856f76f4802c5d7e3d20e343185188de1e2db",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "504d4721ee8e432af4b5f196a08af38bc4dac5fe",
        "lessThan": "2bf4c101d7c99483b8b15a0c8f881e3f399f7e18",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "504d4721ee8e432af4b5f196a08af38bc4dac5fe",
        "lessThan": "e66e38d07b31e177ca430758ed97fbc79f27d966",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "504d4721ee8e432af4b5f196a08af38bc4dac5fe",
        "lessThan": "1097bf16501ed5e35358d848b0a94ad2830b0f65",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "504d4721ee8e432af4b5f196a08af38bc4dac5fe",
        "lessThan": "431b122933b197820d319eb3987a67d04346ce9e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "504d4721ee8e432af4b5f196a08af38bc4dac5fe",
        "lessThan": "45c0de18ff2dc9af01236380404bbd6a46502c69",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/lantiq_etop.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3.0"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "3.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "4.19.323",
        "versionType": "semver",
        "lessThanOrEqual": "4.19.*"
      },
      {
        "status": "unaffected",
        "version": "5.4.285",
        "versionType": "semver",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.227",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.168",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.113",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.55",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.10.14",
        "versionType": "semver",
        "lessThanOrEqual": "6.10.*"
      },
      {
        "status": "unaffected",
        "version": "6.11.3",
        "versionType": "semver",
        "lessThanOrEqual": "6.11.*"
      },
      {
        "status": "unaffected",
        "version": "6.12",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/lantiq_etop.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2024-49997

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#26766 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. CVE-2024-49997 · Revision 1Source updated