CVE-2024-6437: On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options ma

Published Jan 10, 2025

Updated

On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options may bypass the feature's set nexthop action and be slow-path forwarded (FIB routed) by the kernel as the packets are trapped to the CPU instead of following the redirect action's destination.

Affected Software

1 affected component

Arista EOS

Remediation

Information

The recommended resolution is to upgrade to a remediated software version that contains the ip software forwarding options action drop CLI command, and configure the command at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2024-6437 has been fixed in the following releases: * 4.32.2F and later releases in the 4.32.x train * 4.31.5M and later releases in the 4.31.x train * 4.30.8M and later releases in the 4.30.x train * 4.29.10M and later releases in the 4.29.x train

Event History

Jan 10, 2025

CVE Published

via MITRE·08:06 PM

Data Sourced

via MITRE·08:06 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverity

Frequently Asked Questions

What is the severity of CVE-2024-6437?

CVE-2024-6437 is categorized as a medium severity vulnerability.

How do I fix CVE-2024-6437?

To resolve CVE-2024-6437, ensure that your Arista EOS devices are updated to the latest software version provided in the security advisory.

What features are impacted by CVE-2024-6437?

CVE-2024-6437 affects Arista EOS platforms when using features like policy-based routing, BGP Flowspec, or interface traffic policies.

What type of traffic is affected by CVE-2024-6437?

CVE-2024-6437 allows certain IP traffic, such as IPv4 packets with IP options, to bypass configured routing features.

Is there a workaround for CVE-2024-6437?

Currently, no specific workarounds are recommended for CVE-2024-6437 aside from updating the software.