CVE-2003-0001: Ethernet NIC drivers fail to pad frames, leaking kernel memory

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityThe flaw is remotely reachable without authentication and has a very high EPSS score, but it only causes partial information disclosure and is not known to be actively exploited.

What it is

Multiple Ethernet NIC device drivers do not pad short frames with null bytes, so the trailing bytes of a frame can contain data from previous packets or kernel memory. This is the flaw demonstrated by Etherleak. It matters because an attacker on the same network segment can read memory contents that were never intended to be transmitted.

Impact

An attacker gains partial disclosure of kernel memory and previously transmitted packet contents, which can expose sensitive data such as credentials or other in-memory secrets. There is no integrity or availability impact.

Attack surface

Reachable remotely over the network by sending malformed or undersized Ethernet frames; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The attacker must be able to deliver frames to the affected interface, typically on the same broadcast domain or path.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.72511, 99.4th percentile), and references include a vendor advisory and US Government/CERT resources, but no public exploit code is tagged in the record.

What to do

• Apply vendor patches or driver updates for the affected NIC drivers (FreeBSD, Linux kernel, Windows 2000, NetBSD) as the primary fix.
• Where patched drivers are unavailable, restrict network access so untrusted hosts cannot send frames to affected interfaces.
• Segment or firewall networks to limit exposure of systems running unpatched drivers.
• Retire or replace end-of-life platforms such as Windows 2000 that no longer receive driver fixes.
• Monitor vendor errata (Red Hat, Oracle and others referenced) for updated driver packages.

Detection

• Capture and inspect undersized Ethernet frames for non-zero padding bytes that resemble prior packet or kernel memory content.
• Monitor for repeated malformed or minimum-size frames from a single source, which may indicate Etherleak-style probing.
• Use IDS/network monitoring rules that flag Ethernet frames shorter than the minimum 60-byte payload with unexpected trailing data.
• Audit driver versions on hosts with affected NICs against vendor patched versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.