PT-2024-33835 · Linux+6 · Linux Kernel+6
Aleksander Jan Bajkowski
·
Published
2024-10-01
·
Updated
2026-03-14
·
CVE-2024-49997
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
A memory disclosure issue has been identified in the Linux kernel, specifically in the
lantiq etop driver. The problem occurs when applying padding to Ethernet frames, as the buffer is not properly zeroed, resulting in memory disclosure. The issue is observed on the wire. To address this, a patch has been applied that utilizes the skb put padto() function to correctly pad Ethernet frames, ensuring the expanded buffer is zeroed. If a packet cannot be padded, it is silently dropped without incrementing statistics. This issue affects Ethernet MACs on Amazon-SE and Danube, which cannot perform packet padding in hardware and thus require software padding.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Ubuntu