CVE-2024-49997: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix memory disclosure When applying padding, the buf...

Description

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix memory disclosure When applying padding, the buffer is not zeroed, which results in memory disclosure. The mentioned data is observed on the wire. This patch uses skb_put_padto() to pad Ethernet frames properly. The mentioned function zeroes the expanded buffer. In case the packet cannot be padded it is silently dropped. Statistics are also not incremented. This driver does not support statistics in the old 32-bit format or the new 64-bit format. These will be added in the future. In its current form, the patch should be easily backported to stable versions. Ethernet MACs on Amazon-SE and Danube cannot do padding of the packets in hardware, so software padding must be applied.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability

1.09%

61.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-212

Affected Software

Vendor	Product	Versions	Update
Linux	Linux Kernel	>= 3.0, < 5.10.227	—
Linux	Linux Kernel	>= 5.11, < 5.15.168	—
Linux	Linux Kernel	>= 5.16, < 6.1.113	—
Linux	Linux Kernel	>= 6.2, < 6.6.55	—
Linux	Linux Kernel	>= 6.7, < 6.10.14	—
Linux	Linux Kernel	>= 6.11, < 6.11.3	—
Linux	Linux Kernel	6.12	Rc1

References

Timeline

Published: Oct 21, 2024
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2024-49997?

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix memory disclosure When applying padding, the buffer is not zeroed, which results in memory disclosure. The mentioned data is observed on the wire. This patch uses skb_put_padto() to pad Ethernet frames properly. The mentioned function zeroes the expanded buffer. In case the packet cannot be padded it is silently dropped. Statistics are also not incremented. This driver does not support statistics in the old 32-bit format or the new 64-bit format. These will be added in the future. In its current form, the patch should be easily backported to stable versions. Ethernet MACs on Amazon-SE and Danube cannot do padding of the packets in hardware, so software padding must be applied.

How severe is CVE-2024-49997?

CVE-2024-49997 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 1.09% probability of exploitation in the next 30 days.

How do I fix CVE-2024-49997?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.