Description
Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | kernel-image-2.2.20-i386 | 2.2.20-5woody3 | DSA-336 |
| Debian 3.0 | kernel-image-2.4.17-ia64 | kernel-image-2.4.17-ia64 | DSA-423 |
| Debian 3.0 | kernel-image-2.4.17-s390 | 2.4.17-2.woody.3 | DSA-442 |
| Debian 3.0 | kernel-image-2.4.18-1-i386 | 2.4.18-8 | DSA-311 |
| Debian 3.0 | kernel-image-2.4.18-i386bf | 2.4.18-5woody1. | DSA-311 |
| Debian 3.0 | kernel-patch-2.4.17-mips | 2.4.17-0.020226.2.woody2 | DSA-332 |
| Debian 3.0 | kernel-patch-2.4.17-s390 | 0.0.20020816-0.woody.2 | DSA-442 |
| Debian 3.0 | kernel-patch-2.4.18-powerpc | 2.4.18-1woody1 | DSA-312 |
| Debian 3.0 | kernel-source-2.2.20 | 2.2.20-5woody2 | DSA-336 |
| Debian 3.0 | kernel-source-2.4.17 | 2.4.17-1woody1 | DSA-332 |
| Debian 3.0 | kernel-source-2.4.18 | 2.4.18-9 | DSA-311 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 3
- Cisco ASA < 8.4.4.6 < 8.2.5.32 - Ethernet Information Leak EDB-26076 · dos · Jun 10, 2013
- Ethernet Device Drivers Frame Padding - 'Etherleak' Infomation Leakage EDB-3555 · remote · Mar 23, 2007 · verified
- Linux Kernel 2.0.x/2.2.x/2.4.x (FreeBSD 4.x) - Network Device Driver Frame Padding Information Disclosure EDB-22131 · remote · Mar 23, 2007 · verified
GitHub 1 repository
-
marb08/etherleak-checker ★ 5 · Oct 1, 2024
This Python script helps to detect the Etherleak (CVE-2003-0001) vulnerability on a target host by analyzing the padding data in network packets. The script uses Scapy to send various types of reques…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- DSA-423 linux-kernel-2.4.17-ia64 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-442 linux-kernel-2.4.17-s390 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-311 linux-kernel-2.4.18 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-336 linux-kernel-2.2.20 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-332 linux-kernel-2.4.17 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-312 kernel-patch-2.4.18-powerpc - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20030117 Re: More information regarding Etherleak mailing-list
- 1031583 vdb-entry
- 9962 vdb-entry
- RHSA-2003:088 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- 20030110 More information regarding Etherleak mailing-list
- VU#412115 third-party-advisory
- 20030106 Etherleak: Ethernet frame padding information leakage (A010603-1) mailing-list
- oval:org.mitre.oval:def:2665 vdb-entry signature
- 20030110 More information regarding Etherleak mailing-list
- RHSA-2003:025 vendor-advisory
- 7996 third-party-advisory
- A010603-1 vendor-advisory
- 1040185 vdb-entry
- http://www.atstake.com/research/advisories/2003/atstake_etherleak_report.pdf