Vulnerability Note VU#412115

Network device drivers reuse old frame buffer data to pad packets

Original Release date: 06 Jan 2003 | Last revised: 25 Jul 2003

Overview

Many network device drivers reuse old frame buffer data to pad packets, resulting in an information leakage vulnerability that may allow remote attackers to harvest sensitive information from affected devices.

Description

The Ethernet standard (IEEE 802.3) specifies a minimum data field size of 46 bytes. If a higher layer protocol such as IP provides packet data that is smaller than 46 bytes, the device driver must fill the remainder of the data field with a "pad". For IP datagrams, RFC1042 specifies that "the data field should be padded (with octets of zero) to meet the IEEE 802 minimum frame size requirements."

Researchers from @Stake have discovered that, contrary to the recommendations of RFC1042, many Ethernet device drivers fail to pad frames with null bytes. Instead, these device drivers reuse previously transmitted frame data to pad frames smaller than 46 bytes. This constitutes an information leakage vulnerability that may allow remote attackers to harvest potentially sensitive information. Depending upon the implementation of an affected device driver, the leaked information may originate from dynamic kernel memory, from static system memory allocated to the device driver, or from a hardware buffer located on the network interface card.

For detailed information on this research, please read @Stake's "EtherLeak: Ethernet frame padding information leakage", available at


This vulnerability may also affect link layer networking protocols other than Ethernet.

Impact

This vulnerability allows remote attackers to harvest potentially sensitive information from network traffic. In some network environments, this vulnerability can also be used to circumvent technologies that divide networks into separate domains, such as VLANs and routers.

Solution

Apply a patch from your vendor

For vendor-specific information regarding vulnerability status and patch availability, please consult the Systems Affected section of this document

Use encryption to protect sensitive data


By using encryption to protect network traffic, vulnerable sites can greatly reduce the impact of this vulnerability. Affected device drivers will still leak information, but fragments of encrypted information will be useless to attackers. Note that this workaround will not protect sensitive information leaked from non-network sources such as kernel memory.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
DebianAffected25 Jun 200225 Jul 2003
Guardian Digital Inc. Affected25 Jun 200224 Mar 2003
Hewlett-Packard CompanyAffected25 Jun 200225 Jul 2003
IntelAffected25 Jun 200221 Apr 2003
MandrakeSoftAffected25 Jun 200225 Jul 2003
Network ApplianceAffected25 Jun 200208 Jan 2003
Red Hat Inc.Affected25 Jun 200231 Mar 2003
Sun Microsystems Inc.Affected25 Jun 200203 Feb 2003
Xerox CorporationAffected25 Jun 200209 Jun 2003
Apple Computer Inc.Not Affected25 Jun 200210 Jan 2003
ClavisterNot Affected10 Jan 200316 Jan 2003
F5 NetworksNot Affected25 Jun 200203 Jan 2003
HitachiNot Affected03 Jan 200306 Jan 2003
IBMNot Affected25 Jun 200210 Jan 2003
National Semiconductor CorporationNot Affected09 Jan 200316 Jan 2003
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

The CERT/CC thanks Ofir Arkin and Josh Anderson for their discovery and analysis of this vulnerability.

This document was written by Jeffrey P. Lanza.

Other Information

  • CVE IDs: CAN-2003-0001
  • Date Public: 06 Jan 2003
  • Date First Published: 06 Jan 2003
  • Date Last Updated: 25 Jul 2003
  • Severity Metric: 13.50
  • Document Revision: 34

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.