CVE-2024-46854

What it actually does

When transmitting Ethernet frames shorter than 60 bytes the dpaa driver fails to pad to ETH_ZLEN, exposing up to three bytes of the kernel buffer that follows the packet data.

Why it matters to the business

Short packets can leak small fragments of kernel memory that may contain sensitive data, increasing the risk of information disclosure that could be used to facilitate further attacks on affected Linux systems.

How an attack unfolds

An attacker on a local system crafts or triggers transmission of packets shorter than 60 bytes (for example via ping -s 11); the driver sends the frame without proper padding, allowing the subsequent uninitialized bytes to be observed on the wire or in packet captures.

How to fix it

Update the Linux kernel to a version containing commit cd5b9d657ecd44ad5f254c3fea3a6ab1cf0e2ef7 or later; rebuild and deploy the patched kernel image on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains the cited commit or a backport that enforces ETH_ZLEN padding; reproduce the original ping -s 11 test and verify that no extra bytes appear after the data in captured frames.

Typical attack path

1. Obtain local access or the ability to trigger packet transmission on a vulnerable system
2. Generate or force transmission of frames under 60 bytes in length
3. Capture the resulting frames to read the leaked bytes that follow the intended data
4. Use the disclosed memory contents to aid further exploitation or reconnaissance

How to detect it

Inspect network captures and system logs for unusually short frames originating from dpaa interfaces; look for packet lengths below ETH_ZLEN without proper zero padding in the final bytes.

What your security team should do

• Prioritize kernel updates on all systems using the dpaa network driver
• Apply the patch referenced by commit cd5b9d657ecd44ad5f254c3fea3a6ab1cf0e2ef7 immediately where feasible
• Monitor upstream stable kernel releases for additional backports
• Review network configurations to reduce unnecessary transmission of very small packets until patches are applied