There is a workaround and a mitigation that address this vulnerability.
The only workaround that fully mitigates this vulnerability is disabling BFD hardware offload. Creating Infrastructure Access Control Lists (iACLs) is a mitigation that only limits the attack surface.
Disable BFD Hardware Offload
To disable BFD hardware offload, remove any of the hw-module bfw-hw-offload enable commands and reset the assigned line card, as shown in the following example:
RP/0/RSP0/CPU0:ASR9006#config terminal
Wed Mar 8 16:00:00.000 UTC
RP/0/RSP0/CPU0:ASR9006(config)#no hw-module bfd-hw-offload enable location 0/2/CPU0
RP/0/RSP0/CPU0:ASR9006(config)#commit
RP/0/RSP0/CPU0:ASR9006(config)#end
RP/0/RSP0/CPU0:ASR9006#hw-module subslot 0/2/CPU0 reload
Create Infrastructure Access Control Lists
While iACLs limit the attack surface, they do not prevent exploitation from allowed peers and are subject to spoofing.
The following example shows an iACL that allows only infrastructure BFD peers (where 192.0.2.x/24 is the infrastructure address space):
RP/0/RSP0/CPU0:ASR9006# show running-config ipv4 access-list
ipv4 access-list BFD_DROP
5 remark * Mark sure to Allow Legitimate BFD peers *
10 permit udp 192.0.2.0 0.0.0.255 192.0.2.0 0.0.0.255 eq bfd
11 remark * Depending on BFD deployment may need *
12 permit udp 192.0.2.0 0.0.0.255 192.0.2.0 0.0.0.255 eq 4784
13 permit udp 192.0.2.0 0.0.0.255 192.0.2.0 0.0.0.255 eq 6784
15 remark * Drop all other attempts to the infrastructure address space *
20 deny udp any 192.0.2.0 0.0.0.255 eq bfd
30 permit ipv4 any any
!
RP/0/RSP0/CPU0:ASR9006#
Apply this iACL to all exposed interfaces.
The following example shows an iACL that allows only BFD packets with a Time to Live (TTL) of 255 (expected for single hop sessions):
RP/0/RSP0/CPU0:ASR9006# show running-config ipv4 access-list
ipv4 access-list BFD_DROP_TTL
5 remark * Drop based purely on TTL. Allow our Single Hop BFD sessions *
10 permit udp any 192.0.2.0 0.0.0.255 eq bfd ttl eq 255
11 remark * Depending on BFD deployment may need *
12 permit udp any 192.0.2.0 0.0.0.255 eq 4784 ttl eq 255
13 permit udp any 192.0.2.0 0.0.0.255 eq 6784 ttl eq 255
14 remark * You would need to tune the above two lines for multi-hop sessions *
15 remark * Deny anything else for BFD *
20 deny udp any any eq bfd ttl lt 255
21 remark * You would need to tune the above line for multi-hop sessions *
30 permit ipv4 any any
!
RP/0/RSP0/CPU0:ASR9006#
Apply this iACL to all exposed interfaces.
While this workaround and mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.