Cisco Security Advisory
Cisco IOS XR Software UDP Packet Memory Exhaustion Vulnerability
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:X/RL:X/RC:X
-
A vulnerability in the multicast traceroute version 2 (Mtrace2) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust the UDP packet memory of an affected device.
This vulnerability exists because the Mtrace2 code does not properly handle packet memory. An attacker could exploit this vulnerability by sending crafted packets to an affected device. A successful exploit could allow the attacker to exhaust the incoming UDP packet memory. The affected device would not be able to process higher-level UDP-based protocols packets, possibly causing a denial of service (DoS) condition.
Note: This vulnerability can be exploited using IPv4 or IPv6.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pak-mem-exhst-3ke9FeFyThis advisory is part of the September 2024 release of the Cisco IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2024 Semiannual Cisco IOS XR Software Security Advisory Bundled Publication.
-
Vulnerable Products
This vulnerability affects Cisco devices if they were running a vulnerable release of Cisco IOS XR Software and are processing Mtrace2 packets.
Cisco IOS XR Software releases earlier than Release 7.7.1 are not affected.
Cisco IOS XR Software releases 7.7.1 through 7.11.2 are affected if the multicast RPM Packet Manager (RPM) is installed and active on the device, regardless of any multicast configuration.
Cisco IOS XR Software releases 24.1.1 and later are affected if the multicast RPM is installed and active and the device has a multicast configuration. If multicast is not configured, the device is not vulnerable.
For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.
Determine Whether the Multicast RPM is Active
To determine whether the multicast RPM is active, use the show install active summary | include mcast command. If that command returns an empty output, the multicast RPM is not active.
Determine Whether Mtrace2 Processing is Enabled
To determine whether the device is processing Mtrace2 packets, use the show lpts pifib hardware entry brief location
| include 33433 command and the show lpts pifib entry brief | include 33433 command to see if LPTS entries are created for the Mtrace2 port. If both commands return empty output, the device is not processing Mtrace2 packets. In the following examples, the device does create LPTS entries and will process Mtrace2 packets:
RP/0/RP0/CPU0:Router#show lpts pifib hardware entry brief location 0/0/CPU0 | include 33433 IPV4 any any any 0 17 33433 0 0 UDP-listen Dlvr RP0 LOW 0 0 0-default IPV4 any any any 0 17 33433 0 1 UDP-listen Dlvr RP0 LOW 0 0 0-default IPV4 any any any 0 17 33433 0 2 UDP-listen Dlvr RP0 LOW 0 0 0-default IPV4 any any any 0 17 33433 0 0 UDP-listen Dlvr RP0 LOW 0 0 0-default IPV4 any any any 0 17 33433 0 1 UDP-listen Dlvr RP0 LOW 0 0 0-default IPV4 any any any 0 17 33433 0 2 UDP-listen Dlvr RP0 LOW 0 0 0-default RP/0/RP0/CPU0:Router# RP/0/RP0/CPU0:Router# show lpts pifib entry brief | include 33433 IPv4 default UDP any 0/RP0/CPU0 any,33433 any IPv6 default UDP any 0/RP0/CPU0 any,33433 any
Note: Mtrace2 on Cisco IOS XR Software uses the non-standard port 33433 instead of the standard RFC port of 33435.
Products Confirmed Not Vulnerable
Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.
Cisco has confirmed that this vulnerability does not affect the following Cisco products:
- IOS Software
- IOS XE Software
- NX-OS Software
-
The show packet memory command can be used to verify the number of packets that are currently held in the packet memory, as shown in the following example:
RP/0/RP0/CPU0:#show packet-memory summary
ProcId JobId Count Percentage Process
4916 328 9 0.18% tcp
4512 1241 1125 22.46% igmp
4527 1246 3875 77.36% mldDuring normal operations, the packet count should be low. If the packet count for the mld process or the igmp process steadily increases or never decreases over several runs of that command, the device is affected by this vulnerability.
-
There are no workarounds that address this vulnerability. However, there are mitigations for this vulnerability.
Deactivate the RPM on Cisco IOS XR Releases 7.7 to 7.11
If the device does not need the multicast configuration, deactivate and remove the multicast RPM. This will close the vulnerable UDP port.
In this example, the multicast package asr9k-mcast-x64-2.0.0.0-r7921.x86_64.rpm is deactivated:
Router# show install active summary | include mcast
asr9k-mcast-x64-2.0.0.0-r7921.x86_64.rpm
Router# install deactivate asr9k-mcast-x64-2.0.0.0-r7921.x86_64.rpm synchronous
Router# install commitUse an Infrastructure Access Control List (iACLs) to Block Port 33433
To protect infrastructure devices and minimize the risk, impact, and effectiveness of direct infrastructure attacks, administrators are advised to deploy iACLs to enforce policies on traffic that is sent to infrastructure equipment. Administrators can construct an iACL by explicitly permitting only authorized traffic that is sent to infrastructure devices in accordance with existing security policies and configurations. For the maximum protection of infrastructure devices, deployed iACLs should be applied in the ingress direction on all interfaces to which an IP address has been configured. An iACL mitigation cannot completely protect against this vulnerability when the attack originates from a trusted source address.
The iACL policy denies unauthorized Mtrace2 communications packets that are sent to UDP port 33433 on affected devices. In the following example, 192.168.60.0/24 is the IP address space that is used by the affected devices. Care should be taken to allow required traffic for routing and administrative access before denying all unauthorized traffic. Whenever possible, infrastructure address space should be distinct from the address space for user and services segments. Using this addressing methodology will assist with the construction and deployment of iACLs.
Note: Mtrace2 also supports IPv6, so a corresponding IPv6 iACL is required if the device has IPv6 configured.
Note: Cisco uses UDP port 33433, not 33435, for Mtrace2.
ipv4 access-list Infrastructure-ACL-Policy
!
!-- The following vulnerability-specific access control entries
!-- (ACEs) can drop Mtrace version 2 communication packets
! deny udp any 192.168.60.0 0.0.0.255 eq 33433
!
!-- Explicit deny ACE for traffic sent to addresses configured
!-- within the infrastructure address space
! deny ip any 192.168.60.0 0.0.0.255
!
!-- Permit or deny all other Layer 3 and Layer 4 traffic in
!-- accordance with existing security policies and configurations
!
!-- Apply iACL to interfaces in the ingress direction
!
interface GigabitEthernet0/0 ipv4 access-group Infrastructure-ACL-Policy inFor additional information about iACLs, see Protecting Your Core: Infrastructure Protection Access Control Lists.
Restart IGMP and MLD Processes
Restarting the Internet Group Management Protocol (IGMP) process or the Multicast Listener Discovery (MLD) process, or both processes, before the device runs out of memory can ensure that other processes will not be affected. (See the Details section for more information.) Restarting these processes does not prevent the device from leaking UDP memory.
Use the process restart mld or process restart igmp command to restart the respective processes.
While these mitigations have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
-
Cisco has released free software updates that address the vulnerability described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels.
Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:
https://www.cisco.com/c/en/us/products/end-user-license-agreement.htmlAdditionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.
The Cisco Support and Downloads page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool.
When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
Customers Without Service Contracts
Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html
Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.
Fixed Releases
In the following table, the left column lists Cisco software releases or trains. The right column indicates whether a release (train) is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability.
Cisco IOS XR Software Release First Fixed Release 7.6 and earlier Not affected. 7.7 to 7.10 Migrate to a fixed release. 7.11 7.11.21 (Oct 2024) 24.1 Migrate to a fixed release. 24.2 24.2.2 (Sep 2024) 24.3.1 and later Not affected. Cisco has released the following umbrella SMUs to address this vulnerability. Customers who require SMUs for releases that are not listed in the following table are advised to contact their support organization.
Cisco IOS XR Software Release Platform SMU Name 7.7.2 IOSXRWBD iosxrwbd-7.7.2.CSCwm05729 7.11.2 IOSXRWBD
NCS5500iosxrwbd-7.11.2.CSCwm05729
ncs5500-7.11.2.CSCwm0572924.1.2 8000 Series 8000-24.1.2.CSCwm05729 The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.
-
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
-
This vulnerability was found during the resolution of a Cisco TAC support case.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Version Description Section Status Date 1.0 Initial public release. - Final 2024-SEP-11
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.