Vulnerability Note VU#412115

Network device drivers reuse old frame buffer data to pad packets

Original Release date: 06 Jan 2003 | Last revised: 03 Sep 2013


Many network device drivers reuse old frame buffer data to pad packets, resulting in an information leakage vulnerability that may allow remote attackers to harvest sensitive information from affected devices.


The Ethernet standard (IEEE 802.3) specifies a minimum data field size of 46 bytes. If a higher layer protocol such as IP provides packet data that is smaller than 46 bytes, the device driver must fill the remainder of the data field with a "pad". For IP datagrams, RFC1042 specifies that "the data field should be padded (with octets of zero) to meet the IEEE 802 minimum frame size requirements."

Researchers from @Stake have discovered that, contrary to the recommendations of RFC1042, many Ethernet device drivers fail to pad frames with null bytes. Instead, these device drivers reuse previously transmitted frame data to pad frames smaller than 46 bytes. This constitutes an information leakage vulnerability that may allow remote attackers to harvest potentially sensitive information. Depending upon the implementation of an affected device driver, the leaked information may originate from dynamic kernel memory, from static system memory allocated to the device driver, or from a hardware buffer located on the network interface card.

For detailed information on this research, please read @Stake's "EtherLeak: Ethernet frame padding information leakage", available at

This vulnerability may also affect link layer networking protocols other than Ethernet.


This vulnerability allows remote attackers to harvest potentially sensitive information from network traffic. In some network environments, this vulnerability can also be used to circumvent technologies that divide networks into separate domains, such as VLANs and routers.


Apply a patch from your vendor

For vendor-specific information regarding vulnerability status and patch availability, please consult the Systems Affected section of this document

Use encryption to protect sensitive data

By using encryption to protect network traffic, vulnerable sites can greatly reduce the impact of this vulnerability. Affected device drivers will still leak information, but fragments of encrypted information will be useless to attackers. Note that this workaround will not protect sensitive information leaked from non-network sources such as kernel memory.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Debian LinuxAffected25 Jun 200225 Jul 2003
Guardian Digital Inc. Affected25 Jun 200224 Mar 2003
Hewlett-Packard CompanyAffected25 Jun 200225 Jul 2003
IntelAffected25 Jun 200221 Apr 2003
Mandriva, Inc.Affected25 Jun 200225 Jul 2003
Network ApplianceAffected25 Jun 200208 Jan 2003
Red Hat, Inc.Affected25 Jun 200231 Mar 2003
Sun Microsystems, Inc.Affected25 Jun 200203 Feb 2003
Xerox CorporationAffected25 Jun 200209 Jun 2003
Apple Computer, Inc.Not Affected25 Jun 200210 Jan 2003
Check PointNot Affected13 Jan 200303 Sep 2013
ClavisterNot Affected10 Jan 200316 Jan 2003
F5 Networks, Inc.Not Affected25 Jun 200203 Jan 2003
HitachiNot Affected03 Jan 200306 Jan 2003
IBM CorporationNot Affected25 Jun 200210 Jan 2003
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A



The CERT/CC thanks Ofir Arkin and Josh Anderson for their discovery and analysis of this vulnerability.

This document was written by Jeffrey P. Lanza.

Other Information

  • CVE IDs: CAN-2003-0001
  • Date Public: 06 Jan 2003
  • Date First Published: 06 Jan 2003
  • Date Last Updated: 03 Sep 2013
  • Severity Metric: 13.50
  • Document Revision: 34


If you have feedback, comments, or additional information about this vulnerability, please send us email.