{ "document": { "category": "security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "publisher": { "category": "vendor", "contact_details": "support@arista.com", "name": "Arista PSIRT", "namespace": "https://www.arista.com" }, "references": [ { "category": "self", "summary": "Security advisory 106 canonical URL", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/20649-security-advisory-0106" } ], "title": "Security Advisory 106", "tracking": { "current_release_date": "2025-05-07T21:49:09Z", "generator": { "engine": { "name": "Arista Networks SecEng Service CSAF Generator" } }, "id": "Arista Networks Security Advisory 106", "initial_release_date": "2025-05-07T21:49:09Z", "revision_history": [ { "date": "2025-05-07T21:49:09Z", "number": "1", "summary": "Document created" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "EOS version 4.31.5", "product": { "name": "EOS version 4.31.5", "product_id": "CSAFPID-5" } }, { "category": "product_version", "name": "EOS version 4.29.9", "product": { "name": "EOS version 4.29.9", "product_id": "CSAFPID-2" } }, { "category": "product_version", "name": "EOS version 4.28.1", "product": { "name": "EOS version 4.28.1", "product_id": "CSAFPID-4" } }, { "category": "product_version", "name": "EOS version 4.33.0", "product": { "name": "EOS version 4.33.0", "product_id": "CSAFPID-1" } }, { "category": "product_version", "name": "EOS version 4.28.12", "product": { "name": "EOS version 4.28.12", "product_id": "CSAFPID-0" } }, { "category": "product_version", "name": "EOS version 4.32.3", "product": { "name": "EOS version 4.32.3", "product_id": "CSAFPID-3" } }, { "category": "product_version", "name": "EOS version 4.30.8", "product": { "name": "EOS version 4.30.8", "product_id": "CSAFPID-6" } } ], "category": "product_name", "name": "EOS" } ], "category": "product_family", "name": "Software Products" } ], "category": "vendor", "name": "Arista Networks, Inc." } ] }, "vulnerabilities": [ { "cve": "CVE-2024-5872", "id": { "system_name": "Arista Bug ID", "text": "884202" }, "notes": [ { "category": "description", "text": "On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane behavior related to the packet, such as route flaps, multicast routes learnt, etc.", "title": "CVE Description" }, { "category": "other", "text": "There are multiple conditions which must be met. An L3 interface must be configured on the device and at least one of four additional conditions, detailed below and labeled 1 through 4, must be met. In addition to the configuration the packet being sent must have an incorrect VLAN tag.\n\nIn order to be vulnerable to CVE-2024-5872, an L3 interface MUST be configured on the device.\n\nTo check IPv4 L3 interface configuration:\n\nSwitch>show ip interface brief\n Address\nInterface IP Address Status Protocol MTU Owner\n------------- ------------------ --------- ---------- ------ -------\nEthernet5/1 5.1.1.1/24 up up 1500\nManagement1 10.240.112.30/25 up up 1500\nVlan4 4.1.1.1/24 up up 1500\n \nTo check IPv6 L3 interface configuration:\n\nSwitch>show ipv6 interface brief\nInterface Status MTU IPv6 Address Addr State Addr Source\n--------- ------- ---- ----------------------- ---------- -----------\nMa1 up 1500 fe80::d3ff:fe5f:73e9/64 up link local\n fdfd:5c41:712d::701e/64 up config\nVl4 up 1500 fe80::d3ff:fe5f:73ea/64 up link local\n 120::1/120 up config\n \nAND\nAt least one of the following conditions (#’s 1-4 below) must be met:\n\nEither IPv4 routing or IPv6 routing is not configured, which will cause the vulnerability to impact IPv4 unicast packets or IPv6 unicast packets, respectively:\nSwitch>show ip\n \nIP Routing : Disabled\nIP Multicast Routing : Disabled\nIPv6 Multicast Routing : Disabled\nIPv6 Interfaces Forwarding : None\n \nIPv6 Unicast Routing : Disabled\nOR\nFor packets with TTL of 0 or 1, all IP configurations are vulnerable.\n \nOR\nUnicast and multicast routing must be configured for IPv4 to be vulnerable for IPv4 multicast packets, and IPv4 multicast must be enabled on an L3 interface:\nSwitch>show ip\n \nIP Routing : Enabled\nIP Multicast Routing : Enabled\nIPv6 Multicast Routing : Disabled\nIPv6 Interfaces Forwarding : None\n\n\nIPv6 Unicast Routing : Disabled\nSwitch(config-if-Vl4)#show active\ninterface Vlan4\n ip address 4.1.1.1/24\n pim ipv4 sparse-mode\nOR\nUnicast and multicast routing must be configured for IPv6 to be vulnerable to IPv6 multicast packets, and IPv6 multicast must be enabled on an L3 interface:\nSwitch>show ip\n \nIP Routing : Disabled\nIP Multicast Routing : Disabled\nIPv6 Multicast Routing : Enabled\nIPv6 Interfaces Forwarding : None\n \nIPv6 Unicast Routing : Enabled\nSwitch(config-if-Vl4)#show active\ninterface Vlan4\n ipv6 address 120::1/120\n pim ipv6 sparse-mode", "title": "884202: Required Config for Exploitation" } ], "product_status": { "first_affected": [ "CSAFPID-4" ], "fixed": [ "CSAFPID-0", "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-5", "CSAFPID-6" ] }, "references": [ { "category": "external", "summary": "MITRE", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5872" } ], "remediations": [ { "category": "vendor_fix", "details": "Fixed in EOS version 4.28.12", "product_ids": [ "CSAFPID-0" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.29.9", "product_ids": [ "CSAFPID-2" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.30.8", "product_ids": [ "CSAFPID-6" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.31.5", "product_ids": [ "CSAFPID-5" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.32.3", "product_ids": [ "CSAFPID-3" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.33.0", "product_ids": [ "CSAFPID-1" ] }, { "category": "none_available", "details": "Not fixed in EOS version 4.28.1", "product_ids": [ "CSAFPID-4" ] }, { "category": "mitigation", "details": "There is no workaround." } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-4", "CSAFPID-3", "CSAFPID-5", "CSAFPID-0", "CSAFPID-1", "CSAFPID-6", "CSAFPID-2" ] } ], "title": "CVE-2024-5872" } ] }