CyberSecBulletin
CVE-2024-49997NVD status: Modified

Linux: Improper Removal of Sensitive Information Before Storage or Transfer

Published Updated By the CyberSecBulletin desk

CVE-2024-49997 is a high-severity improper removal of sensitive information before storage or transfer vulnerability in Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 905f06a34f960676e7dc77bea00f2f8fe18177ad, 60c068444c20bf9a3e22b65b5f6f3d9edc852931, 185df159843d30fb71f821e7ea4368c2a3bfcd36 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 1.06% chance of exploitation within 30 days, higher than 65% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 905f06a34f960676e7dc77bea00f2f8fe18177ad or 60c068444c20bf9a3e22b65b5f6f3d9edc852931 or 185df159843d30fb71f821e7ea4368c2a3bfcd36 or 469856f76f4802c5d7e3d20e343185188de1e2db, whichever matches your release line, or a later version.
  2. Update SIMATIC S7-1500 CPU 1518-4 PN/DP MFP to V3.1.5 or a later version.
  3. Update SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP to V3.1.5 or a later version.
  4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux504d4721ee8e432af4b5f196a08af38bc4dac5fe up to, but not including, 905f06a34f960676e7dc77bea00f2f8fe18177ad; 504d4721ee8e432af4b5f196a08af38bc4dac5fe up to, but not including, 60c068444c20bf9a3e22b65b5f6f3d9edc852931; 504d4721ee8e432af4b5f196a08af38bc4dac5fe up to, but not including, 185df159843d30fb71f821e7ea4368c2a3bfcd36; 504d4721ee8e432af4b5f196a08af38bc4dac5fe up to, but not including, 469856f76f4802c5d7e3d20e343185188de1e2db; 504d4721ee8e432af4b5f196a08af38bc4dac5fe up to, but not including, 2bf4c101d7c99483b8b15a0c8f881e3f399f7e18; 504d4721ee8e432af4b5f196a08af38bc4dac5fe up to, but not including, e66e38d07b31e177ca430758ed97fbc79f27d966; 504d4721ee8e432af4b5f196a08af38bc4dac5fe up to, but not including, 1097bf16501ed5e35358d848b0a94ad2830b0f65; 504d4721ee8e432af4b5f196a08af38bc4dac5fe up to, but not including, 431b122933b197820d319eb3987a67d04346ce9e; and 2 more ranges905f06a34f960676e7dc77bea00f2f8fe18177ad, 60c068444c20bf9a3e22b65b5f6f3d9edc852931, 185df159843d30fb71f821e7ea4368c2a3bfcd36, 469856f76f4802c5d7e3d20e343185188de1e2db, 2bf4c101d7c99483b8b15a0c8f881e3f399f7e18, e66e38d07b31e177ca430758ed97fbc79f27d966
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 up to, but not including, V3.1.5V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 up to, but not including, V3.1.5V3.1.5
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystembefore V1.1.1V1.1.1
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 up to, but not including, V3.1.5V3.1.5
SiemensRUGGEDCOM RST2428Pbefore V3.2V3.2
SiemensSCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 familybefore V3.2V3.2
SiemensSCALANCE XCM-/XRM-/XCH-/XRH-300 familybefore V3.2V3.2
LinuxLinux Kernel3.0 up to, but not including, 5.10.227; 5.11 up to, but not including, 5.15.168; 5.16 up to, but not including, 6.1.113; 6.2 up to, but not including, 6.6.55; 6.7 up to, but not including, 6.10.14; 6.11 up to, but not including, 6.11.3; 6.125.10.227, 5.15.168, 6.1.113, 6.6.55, 6.10.14, 6.11.3

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
NoneAvailability is not affected.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix memory disclosure When applying padding, the buffer is not zeroed, which results in memory disclosure. The mentioned data is observed on the wire. This patch uses skb_put_padto() to pad Ethernet frames properly. The mentioned function zeroes the expanded buffer. In case the packet cannot be padded it is silently dropped. Statistics are also not incremented. This driver does not support statistics in the old 32-bit format or the new 64-bit format. These will be added in the future. In its current form, the patch should be easily backported to stable versions. Ethernet MACs on Amazon-SE and Danube cannot do padding of the packets in hardware, so software padding must be applied.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Removal of Sensitive Information Before Storage or Transfer

The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

How developers prevent this class of flaw

  • Clearly specify which information should be regarded as private or sensitive, and require that the product offers functionality that allows the user to cleanse the sensitive information from the resource before it is published or exported to other parties.
  • Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
  • Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.

More Improper Removal of Sensitive Information Before Storage or Transfer vulnerabilities (CWE-212)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Removal of Sensitive Information Before Storage or Transfer vulnerabilities

Spotted an error? Tell us.