CVE-2024-20318: Input Validation
First published: Wed Mar 13 2024(Updated: )
A vulnerability in the Layer 2 Ethernet services of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the line card network processor to reset, resulting in a denial of service (DoS) condition. This vulnerability is due to the incorrect handling of specific Ethernet frames that are received on line cards that have the Layer 2 services feature enabled. An attacker could exploit this vulnerability by sending specific Ethernet frames through an affected device. A successful exploit could allow the attacker to cause the ingress interface network processor to reset, resulting in a loss of traffic over the interfaces that are supported by the network processor. Multiple resets of the network processor would cause the line card to reset, resulting in a DoS condition.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XRv 9000 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-20318?
CVE-2024-20318 is rated as a high severity vulnerability due to its potential to cause denial of service.
How does CVE-2024-20318 affect Cisco IOS XR Software?
CVE-2024-20318 affects the Layer 2 Ethernet services of Cisco IOS XR Software, allowing an unauthenticated attacker to reset the network processor.
What are the potential impacts of CVE-2024-20318?
The impact of CVE-2024-20318 is a denial of service condition leading to an outage of affected devices.
How can I mitigate the effects of CVE-2024-20318?
Mitigation for CVE-2024-20318 includes applying the latest patches or updates provided by Cisco for IOS XR Software.
Is there a workaround for CVE-2024-20318?
There are no specific workarounds for CVE-2024-20318, and immediate update to the software is recommended to avoid vulnerability exploitation.
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios xrv 9000