Although there are no workarounds for these vulnerabilities, there are multiple mitigations available to customers depending on their needs.
As a mitigation for the memory exhaustion case, it is recommended that customers implement a rate limiter. This will require that customers understand their current rate of IGMP traffic and set a rate lower than the current average rate. It is worth noting that there is a default limiter in place. In configuration mode, the customer can enter the lpts pifib hardware police flow igmp rate command as follows:
RP/0/0/CPU0:router(config)# lpts pifib hardware police flow igmp rate
This command will not remove the exploit vector. However, the command will reduce the traffic rate and increase the time necessary for successful exploitation. The customer can use this time to perform recovery actions.
As a mitigation for both the memory exhaustion case and the immediate IGMP process crash case, customers may implement an access control entry (ACE) to an existing interface access control list (ACL). Alternatively, the customer can create a new ACL for a specific interface that denies DVMRP traffic inbound on that interface. The following example creates an ACL and denies DVMRP traffic:
RP/0/0/CPU0:router(config)# ipv4 access-list deny igmp any any dvmrp