CVE-2024-49997

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix memory disclosure When applying padding, the buffer is not zeroed, which results in memory disclosure. The mentioned data is observed on the wire. This patch uses skb_put_padto() to pad Ethernet frames properly. The mentioned function zeroes the expanded buffer. In case the packet cannot be padded it is silently dropped. Statistics are also not incremented. This driver does not support statistics in the old 32-bit format or the new 64-bit format. These will be added in the future. In its current form, the patch should be easily backported to stable versions. Ethernet MACs on Amazon-SE and Danube cannot do padding of the packets in hardware, so software padding must be applied.

• CWE-212

• https://git.kernel.org/stable/c/1097bf16501ed5e35358d848b0a94ad2830b0f65Patch
• https://git.kernel.org/stable/c/185df159843d30fb71f821e7ea4368c2a3bfcd36Patch
• https://git.kernel.org/stable/c/2bf4c101d7c99483b8b15a0c8f881e3f399f7e18Patch
• https://git.kernel.org/stable/c/431b122933b197820d319eb3987a67d04346ce9ePatch
• https://git.kernel.org/stable/c/45c0de18ff2dc9af01236380404bbd6a46502c69Patch
• https://git.kernel.org/stable/c/469856f76f4802c5d7e3d20e343185188de1e2dbPatch
• https://git.kernel.org/stable/c/60c068444c20bf9a3e22b65b5f6f3d9edc852931
• https://git.kernel.org/stable/c/905f06a34f960676e7dc77bea00f2f8fe18177ad
• https://git.kernel.org/stable/c/e66e38d07b31e177ca430758ed97fbc79f27d966Patch
• https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
• https://cert-portal.siemens.com/productcert/html/ssa-265688.html
• https://cert-portal.siemens.com/productcert/html/ssa-355557.html
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Published

Oct 21, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-49991In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-49992In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-49993Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-49994In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-49995Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-49996In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-49998In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2024-49999In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-5000An unauthenticated remote attacker can use a malicious OPC U…7.5
• CVE-2024-50000In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-50001In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-50002In the Linux kernel, the following vulnerability has been re…5.5