EtherLeak: Ethernet Frame Padding Information ... - Leet Upload

8
02 write_packet(ioaddr, length, skb->data, dev->if_port);
}
lp->pac_cnt_in_tx_buf++;
if (lp->tx_unit_busy == 0) {
trigger_send(ioaddr, length);
lp->saved_tx_size = 0; /* Redundant */
lp->re_tx = 0;
lp->tx_unit_busy = 1;
} else
lp->saved_tx_size = length;
/* Re-enable the LPT interrupts. */
write_reg(ioaddr, IMR, ISR_RxOK | ISR_TxErr | ISR_TxOK);
write_reg_high(ioaddr, IMR, ISRh_RxErr);
dev->trans_start = jiffies;
dev_kfree_skb (skb);
return 0;
The skb structure contains a pointer to the frame construction buffer at skb->data and
the size of the frame within that buffer at skb->len. The code at line 01 uses a C
language construct to initialize length to the greater of the two size values: ETH_ZLEN or
skb->len. Therefore, if the length of the frame is less than the Ethernet minimum
(ETH_ZLEN) it will be rounded up to that minimum. The value of length is then used
when copying the frame out from the skb->data buffer to the hardware device (line 02).
The contents of the pad bytes is heavily dependent on system load. Due to the large
address space of kernel memory and small number of pad bytes it is extremely unlikely
that sensitive information will be leaked. However the origin of these pad bytes makes
any such information potentially devastating.
3.2.2 Frame Capture
The following packet capture demonstrates how the contents of the pad bytes change as
different portions of kernel memory are used for the construction of ICMP echo reply
packets.
14:18:48.146095 10.50.1.60 > 10.50.1.53: icmp: echo request (DF) (ttl
64, id 0, len 29)
4500 001d 0000 4000 4001 240c 0a32 013c
0a32 0135 0800 83f9 5206 2200 00
14:18:48.146393 10.50.1.53 > 10.50.1.60: icmp: echo reply (ttl 255,
id 3747, len 29)
4500 001d 0ea3 0000 ff01 9668 0a32 0135
0a32 013c 0000 8bf9 5206 2200 0059 0100
6c02 0000 c006 0000 0600 0000 0010
14:18:49.146095 10.50.1.60 > 10.50.1.53: icmp: echo request (DF) (ttl
64, id 0, len 29)
4500 001d 0000 4000 4001 240c 0a32 013c
0a32 0135 0800 82f9 5206 2300 00
14:18:49.146387 10.50.1.53 > 10.50.1.60: icmp: echo reply (ttl 255,
id 3749, len 29)
4500 001d 0ea5 0000 ff01 9666 0a32 0135
0a32 013c 0000 8af9 5206 2300 0000 4003
2300 4003 f101 1200 ed01 feff 0000
EtherLeak: Ethernet frame padding information leakage
Copyright © 2003, @stake Inc. All Rights Reserved.