Vulnslist

find the latest Cisco vulnerabilities

Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities

cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz · High · Published · Updated

Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually crash. The memory consumption may negatively impact other processes that are running on the device.  These vulnerabilities are due to the incorrect handling of IGMP packets. An attacker could exploit these vulnerabilities by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to immediately crash the IGMP process or cause memory exhaustion, resulting in other processes becoming unstable. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. There are multiple mitigations available to customers depending on their needs. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz

Workarounds

Although there are no workarounds for these vulnerabilities, there are multiple mitigations available to customers depending on their needs.

As a mitigation for the memory exhaustion case, it is recommended that customers implement a rate limiter. This will require that customers understand their current rate of IGMP traffic and set a rate lower than the current average rate. It is worth noting that there is a default limiter in place. In configuration mode, the customer can enter the lpts pifib hardware police flow igmp rate command as follows:

RP/0/0/CPU0:router(config)# lpts pifib hardware police flow igmp rate

This command will not remove the exploit vector. However, the command will reduce the traffic rate and increase the time necessary for successful exploitation. The customer can use this time to perform recovery actions.

As a mitigation for both the memory exhaustion case and the immediate IGMP process crash case, customers may implement an access control entry (ACE) to an existing interface access control list (ACL). Alternatively, the customer can create a new ACL for a specific interface that denies DVMRP traffic inbound on that interface. The following example creates an ACL and denies DVMRP traffic:

RP/0/0/CPU0:router(config)# ipv4 access-list deny igmp any any dvmrp

CVEsCVE-2020-3566, CVE-2020-3569
Cisco Bug IDsCSCvv54838, CSCvr86414
CVSS ScoreBase 8.6
Base 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:X/RL:X/RC:X
Product Names From Source
Cisco IOS XR Software

CSAF Product Statuses

Product Status Source CVE Rows
Cisco IOS XR Software known_affected cisco_csaf CVE-2020-3566, CVE-2020-3569 2

Related Products

Product CVE Evidence
Cisco IOS XR Software CVE-2020-3569 Cisco OpenVuln
Cisco IOS CVE-2020-3569 Cisco OpenVuln
Cisco IOS Software CVE-2020-3569 Cisco OpenVuln
Cisco IOS XR Software CVE-2020-3566 Cisco OpenVuln
Cisco IOS CVE-2020-3566 Cisco OpenVuln
Cisco IOS Software CVE-2020-3566 Cisco OpenVuln