On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options may bypass the feature's set nexthop action and be slow-path forwarded (FIB routed) by the kernel as the packets are trapped to the CPU instead of following the redirect action's destination.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00048.

Exploitation poc

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Arista Networks EOS-Policy Based Routing (PBR) unaffected
Version Status Constraints
4.32.0F affected ≤ 4.32.1F
4.31.0M affected ≤ 4.31.4M
4.30.0M affected ≤ 4.30.7M
4.29.0M affected ≤ 4.29.9M
4.28.0M affected ≤ 4.28.11M
4.27.0M affected ≤ 4.27.12M
4.26.0M affected ≤ 4.26.14M
4.25.0M affected ≤ 4.25.11M
4.24.0M affected ≤ 4.24.11M
4.23.0M affected ≤ 4.23.15M
4.22.0M affected ≤ 4.22.13M
4.21.0M affected ≤ 4.21.15M
Arista Networks EOS - BGP Flowspec unaffected
Version Status Constraints
4.32.0F affected ≤ 4.32.1F
4.31.0M affected ≤ 4.31.4M
4.30.0M affected ≤ 4.30.7M
4.29.0M affected ≤ 4.29.9M
4.28.0M affected ≤ 4.28.11M
4.27.0M affected ≤ 4.27.12M
4.26.0M affected ≤ 4.26.14M
4.25.0M affected ≤ 4.25.11M
4.24.0M affected ≤ 4.24.11M
4.23.0M affected ≤ 4.23.15M
4.22.0M affected ≤ 4.22.13M
4.21.3F affected ≤ 4.21.15M
Arista Networks EOS - Interface Traffic Policy unaffected
Version Status Constraints
4.32.0F affected ≤ 4.32.1F
4.31.0M affected ≤ 4.31.4M
4.30.0M affected ≤ 4.30.7M
4.29.0M affected ≤ 4.29.9M
4.28.0M affected ≤ 4.28.11M
4.27.2F affected ≤ 4.27.12F

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-48006 On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options may bypass the feature's set nexthop action and be slow-path forwarded (FIB routed) by the kernel as the packets are trapped to the CPU instead of following the redirect action's destination.
Fixes

Solution

The recommended resolution is to upgrade to a remediated software version that contains the ip software forwarding options action drop CLI command, and configure the command at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2024-6437 has been fixed in the following releases: * 4.32.2F and later releases in the 4.32.x train * 4.31.5M and later releases in the 4.31.x train * 4.30.8M and later releases in the 4.30.x train * 4.29.10M and later releases in the 4.29.x train

Workaround

For all affected systems, the suggested mitigation for all three affected features is to drop all IPv4 options traffic via the ip software forwarding options action drop, available in 4.32.2F and later releases in the 4.32 train, 4.31.5M and later releases in the 4.31 train, and 4.30.8M and later releases in the 4.30 train. The command installs an iptables rule that drops all IPv4 options traffic in the filter table of the FORWARD chain. switch(config)#ip software forwarding options action drop # Below is shown to illustrate what the rule does. This is not a command that needs to be run. switch(config)#bash sudo iptables -vnL EOS_FORWARD Chain EOS_FORWARD (1 references)  pkts bytes target     prot opt in     out     source               destination     0     0 DROP       all -- *     *       0.0.0.0/0           0.0.0.0/0           u32 ! "0x0>>0x18=0x45"     0     0 REJECT     all -- *     fwd+   0.0.0.0/0           0.0.0.0/0           u32 ! "0x0>>0x18=0x45" reject-with icmp-admin-prohibited     0     0 DROP       all -- *     ma+     0.0.0.0/0           0.0.0.0/0     0     0 ACCEPT     all -- *     *     !127.0.0.0/8         !127.0.0.0/8   Additionally, in 7280R3, 7500R3, and 7800R3 systems, the system-rule overriding-action redirect command (present in EOS-4.28.0F and newer releases) can be used to allow for all of the affected features' set nexthop action to take precedence over the system ACL's trap action to CPU. See TCAM redirect action overriding system rules - TOI https://www.arista.com/en/support/toi/eos-4-28-0f/15280-tcam-redirect-action-overriding-system-rules  for more information.

References
Link Providers
https://www.arista.com/en/support/advisories-notices/security-advisory/20689-security-advisory-0108 cve-icon cve-icon
History

Fri, 10 Jan 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jan 2025 20:15:00 +0000

Type Values Removed Values Added
Description On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options may bypass the feature's set nexthop action and be slow-path forwarded (FIB routed) by the kernel as the packets are trapped to the CPU instead of following the redirect action's destination.
Title On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options ma
References
Metrics cvssV3_1

{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Arista

Published:

Updated: 2025-01-10T21:12:37.972Z

Reserved: 2024-07-01T22:29:33.582Z

Link: CVE-2024-6437

cve-icon Vulnrichment

Updated: 2025-01-10T21:12:31.502Z

cve-icon NVD

Status : Deferred

Published: 2025-01-10T20:15:30.817

Modified: 2026-04-15T00:35:42.020

Link: CVE-2024-6437

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.