Description
On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options may bypass the feature's set nexthop action and be slow-path forwarded (FIB routed) by the kernel as the packets are trapped to the CPU instead of following the redirect action's destination.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Arista Networks | EOS-Policy Based Routing (PBR) | 4.32.0F – ≤ 4.32.1F, 4.31.0M – ≤ 4.31.4M, 4.30.0M – ≤ 4.30.7M, 4.29.0M – ≤ 4.29.9M, 4.28.0M – ≤ 4.28.11M, 4.27.0M – ≤ 4.27.12M, 4.26.0M – ≤ 4.26.14M, 4.25.0M – ≤ 4.25.11M, 4.24.0M – ≤ 4.24.11M, 4.23.0M – ≤ 4.23.15M, 4.22.0M – ≤ 4.22.13M, 4.21.0M – ≤ 4.21.15M | — |
| Arista Networks | EOS - BGP Flowspec | 4.32.0F – ≤ 4.32.1F, 4.31.0M – ≤ 4.31.4M, 4.30.0M – ≤ 4.30.7M, 4.29.0M – ≤ 4.29.9M, 4.28.0M – ≤ 4.28.11M, 4.27.0M – ≤ 4.27.12M, 4.26.0M – ≤ 4.26.14M, 4.25.0M – ≤ 4.25.11M, 4.24.0M – ≤ 4.24.11M, 4.23.0M – ≤ 4.23.15M, 4.22.0M – ≤ 4.22.13M, 4.21.3F – ≤ 4.21.15M | — |
| Arista Networks | EOS - Interface Traffic Policy | 4.32.0F – ≤ 4.32.1F, 4.31.0M – ≤ 4.31.4M, 4.30.0M – ≤ 4.30.7M, 4.29.0M – ≤ 4.29.9M, 4.28.0M – ≤ 4.28.11M, 4.27.2F – ≤ 4.27.12F | — |
Advisories 1
- WID-SEC-2024-3554 Arista EOS: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 26, 2024