Cisco Security Advisory for DVMRP Vulnerability in IOS XR Software

by CIRT Team

03 Sep 2020

in Security Advisories & Alerts

No Comments

1119

DESCRIPTION
Cisco has released a security advisory on a vulnerability—CVE-2020-3566—in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR software. This vulnerability affects Cisco devices running IOS XR software that have an active interface configured under multicast routing. A remote attacker could exploit this vulnerability to exhaust process memory of an affected device. This vulnerability was detected in exploits in the wild.

IMPACT
An attacker could exploit these vulnerabilities by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to immediately crash the IGMP process or cause memory exhaustion, resulting in other processes becoming unstable. These processes may include, but are not limited to, interior and exterior routing protocols.

SYSTEM AFFECTED
These vulnerabilities affect any Cisco device that is running any release of Cisco IOS XR Software if an active interface is configured under multicast routing and it is receiving DVMRP traffic.

RECOMMENDATIONS
Although there are no workarounds for these vulnerabilities, there are multiple mitigations available to customers depending on their needs.

As a mitigation for the memory exhaustion case, it is recommended that customers implement a rate limiter. This will require that customers understand their current rate of IGMP traffic and set a rate lower than the current average rate. It is worth noting that there is a default limiter in place. In configuration mode, the customer can enter the lpts pifib hardware police flow igmp rate command as follows:

        RP/0/0/CPU0:router(config)# lpts pifib hardware police flow igmp rate <value>

    This command will not remove the exploit vector. However, the command will reduce the traffic rate and increase the time necessary for successful exploitation. The customer can use this time to perform recovery actions.

    As a mitigation for both the memory exhaustion case and the immediate IGMP process crash case, customers may implement an access control entry (ACE) to an existing interface access control list (ACL). Alternatively, the customer can create a new ACL for a specific interface that denies DVMRP traffic inbound on that interface. The following example creates an ACL and denies DVMRP traffic:

        RP/0/0/CPU0:router(config)# ipv4 access-list <acl_name> deny igmp any any dvmrp

REFERENCES