Vulnerability Note VU#412115

Network device drivers reuse old frame buffer data to pad packets

Overview

Many network device drivers reuse old frame buffer data to pad packets, resulting in an information leakage vulnerability that may allow remote attackers to harvest sensitive information from affected devices.

I. Description

The Ethernet standard (IEEE 802.3) specifies a minimum data field size of 46 bytes. If a higher layer protocol such as IP provides packet data that is smaller than 46 bytes, the device driver must fill the remainder of the data field with a "pad". For IP datagrams, RFC1042 specifies that "the data field should be padded (with octets of zero) to meet the IEEE 802 minimum frame size requirements."

Researchers from @Stake have discovered that, contrary to the recommendations of RFC1042, many Ethernet device drivers fail to pad frames with null bytes. Instead, these device drivers reuse previously transmitted frame data to pad frames smaller than 46 bytes. This constitutes an information leakage vulnerability that may allow remote attackers to harvest potentially sensitive information. Depending upon the implementation of an affected device driver, the leaked information may originate from dynamic kernel memory, from static system memory allocated to the device driver, or from a hardware buffer located on the network interface card.

For detailed information on this research, please read @Stake's "EtherLeak: Ethernet frame padding information leakage", available at

http://www.atstake.com/research/advisories/2003/atstake_etherleak_report.pdf

This vulnerability may also affect link layer networking protocols other than Ethernet.

II. Impact

This vulnerability allows remote attackers to harvest potentially sensitive information from network traffic. In some network environments, this vulnerability can also be used to circumvent technologies that divide networks into separate domains, such as VLANs and routers.

III. Solution

Apply a patch from your vendor

For vendor-specific information regarding vulnerability status and patch availability, please consult the Systems Affected section of this document

Use encryption to protect sensitive data

By using encryption to protect network traffic, vulnerable sites can greatly reduce the impact of this vulnerability. Affected device drivers will still leak information, but fragments of encrypted information will be useless to attackers. Note that this workaround will not protect sensitive information leaked from non-network sources such as kernel memory.

Systems Affected

Vendor	Status	Date Notified
3Com	Unknown	3-Feb-2003
Alcatel	Unknown	3-Jan-2003
Apple Computer Inc.	Not Vulnerable	10-Jan-2003
Avaya	Unknown	3-Jan-2003
Borderware	Unknown	14-Jan-2003
BSDI	Unknown	3-Jan-2003
Check Point	Unknown	14-Jan-2003
Cisco Systems Inc.	Unknown	24-Mar-2003
Clavister	Not Vulnerable	16-Jan-2003
Computer Associates	Unknown	3-Feb-2003
Conectiva	Unknown	3-Jan-2003
Cray Inc.	Unknown	17-Jan-2003
D-Link Systems	Unknown	3-Jan-2003
Data General	Unknown	3-Jan-2003
Debian	Vulnerable	25-Jul-2003
eSoft	Unknown	14-Jan-2003
F5 Networks	Not Vulnerable	3-Jan-2003
FreeBSD	Unknown	3-Jan-2003
Fujitsu	Unknown	3-Jan-2003
Global Technology Associates	Unknown	14-Jan-2003
Guardian Digital Inc.	Vulnerable	24-Mar-2003
Hewlett-Packard Company	Vulnerable	25-Jul-2003
Hitachi	Not Vulnerable	6-Jan-2003
IBM	Not Vulnerable	10-Jan-2003
Intel	Vulnerable	21-Apr-2003
Intoto	Unknown	14-Jan-2003
IP Filter	Unknown	14-Jan-2003
Juniper Networks	Unknown	3-Jan-2003
Lachman	Unknown	3-Jan-2003
Linksys	Unknown	14-Jan-2003
Lotus Software	Unknown	3-Jan-2003
Lucent Technologies	Unknown	3-Jan-2003
MandrakeSoft	Vulnerable	25-Jul-2003
Microsoft Corporation	Unknown	25-Jul-2003
MontaVista Software	Unknown	3-Jan-2003
National Semiconductor Corporation	Not Vulnerable	16-Jan-2003
NEC Corporation	Not Vulnerable	3-Jan-2003
NetBSD	Unknown	3-Jan-2003
Netfilter.org	Unknown	14-Jan-2003
NetScreen	Unknown	3-Jan-2003
Network Appliance	Vulnerable	8-Jan-2003
Nokia	Unknown	3-Jan-2003
Nortel Networks	Unknown	3-Jan-2003
Novell	Unknown	14-Jan-2003
OpenBSD	Unknown	3-Jan-2003
Openwall GNU/*/Linux	Unknown	3-Jan-2003
Red Hat Inc.	Vulnerable	31-Mar-2003
Redback Networks Inc.	Unknown	3-Jan-2003
Riverstone Networks	Unknown	3-Jan-2003
Secure Computing Corporation	Unknown	14-Jan-2003
SecureWorx	Unknown	14-Jan-2003
Sequent	Unknown	3-Jan-2003
SGI	Unknown	9-Jun-2003
Sony Corporation	Unknown	3-Jan-2003
Stonesoft	Unknown	14-Jan-2003
Sun Microsystems Inc.	Vulnerable	3-Feb-2003
SuSE Inc.	Unknown	3-Jan-2003
Symantec Corporation	Unknown	14-Jan-2003
The SCO Group (SCO Linux)	Unknown	4-Apr-2003
The SCO Group (SCO UnixWare)	Unknown	4-Apr-2003
Unisys	Unknown	3-Jan-2003
WatchGuard	Unknown	14-Jan-2003
Wind River Systems Inc.	Unknown	3-Jan-2003
Wirex	Unknown	3-Jan-2003
Xerox Corporation	Vulnerable	9-Jun-2003
ZyXEL	Not Vulnerable	24-Jul-2003

References

http://www.atstake.com/research/advisories/2003/atstake_etherleak_report.pdf
http://www.atstake.com/research/advisories/2003/a010603-1.txt
http://www.nextgenss.com/advisories/etherleak-2003.txt
http://www.ietf.org/rfc/rfc1042.txt

Credit

The CERT/CC thanks Ofir Arkin and Josh Anderson for their discovery and analysis of this vulnerability.

This document was written by Jeffrey P. Lanza.

Other Information

Date Public:	2003-01-06
Date First Published:	2003-01-06
Date Last Updated:	2003-07-25
CERT Advisory:
CVE-ID(s):	CAN-2003-0001
NVD-ID(s):	CAN-2003-0001
US-CERT Technical Alerts:
Metric:	13.50
Document Revision:	34

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader