cve/2024/CVE-2024-49997.md

### [CVE-2024-49997](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49997)
![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=3.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=504d4721ee8e432af4b5f196a08af38bc4dac5fe%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue)

### Description

In the Linux kernel, the following vulnerability has been resolved:net: ethernet: lantiq_etop: fix memory disclosureWhen applying padding, the buffer is not zeroed, which results in memorydisclosure. The mentioned data is observed on the wire. This patch usesskb_put_padto() to pad Ethernet frames properly. The mentioned functionzeroes the expanded buffer.In case the packet cannot be padded it is silently dropped. Statisticsare also not incremented. This driver does not support statistics in theold 32-bit format or the new 64-bit format. These will be added in thefuture. In its current form, the patch should be easily backported tostable versions.Ethernet MACs on Amazon-SE and Danube cannot do padding of the packetsin hardware, so software padding must be applied.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds