CVE-2024-49997

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: ethernet: lantiq_etop: fix memory disclosure<br /> <br /> When applying padding, the buffer is not zeroed, which results in memory<br /> disclosure. The mentioned data is observed on the wire. This patch uses<br /> skb_put_padto() to pad Ethernet frames properly. The mentioned function<br /> zeroes the expanded buffer.<br /> <br /> In case the packet cannot be padded it is silently dropped. Statistics<br /> are also not incremented. This driver does not support statistics in the<br /> old 32-bit format or the new 64-bit format. These will be added in the<br /> future. In its current form, the patch should be easily backported to<br /> stable versions.<br /> <br /> Ethernet MACs on Amazon-SE and Danube cannot do padding of the packets<br /> in hardware, so software padding must be applied.