From owner-freebsd-net  Tue Jan  7 14:15: 3 2003
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 34BAA37B405
	for <net@freebsd.org>; Tue,  7 Jan 2003 14:15:02 -0800 (PST)
Received: from rootlabs.com (root.org [67.118.192.226])
	by mx1.FreeBSD.org (Postfix) with SMTP id 557C243EE1
	for <net@freebsd.org>; Tue,  7 Jan 2003 14:15:01 -0800 (PST)
	(envelope-from nate@rootlabs.com)
Received: (qmail 15716 invoked by uid 1000); 7 Jan 2003 22:15:02 -0000
Date: Tue, 7 Jan 2003 14:15:02 -0800 (PST)
From: Nate Lawson <nate@root.org>
To: security@freebsd.org, net@freebsd.org
Subject: @stake advisory: etherleak
Message-ID: <Pine.BSF.4.21.0301071410440.15714-100000@root.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-net@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-net.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-net>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-net>
X-Loop: FreeBSD.org

The short of it is that if a tx packet is < 64 bytes (min ethernet frame
len), data can be leaked if the driver transmits 64 bytes.  It seems our
use of mbufs would prevent leakage but I haven't examined any drivers to
verify this.

http://www.atstake.com/research/advisories/2003/atstake_etherleak_report.pdf

-Nate


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message