Cisco NX-OS up to 10.4 MPLS buffer overflow

Summaryinfo

A vulnerability labeled as critical has been found in Cisco NX-OS up to 10.4. This impacts an unknown function of the component MPLS Handler. The manipulation results in buffer overflow. This vulnerability is reported as CVE-2024-20267. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in Cisco NX-OS up to 10.4 (Router Operating System). Affected is an unknown part of the component MPLS Handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on availability. CVE summarizes:

A vulnerability with the handling of MPLS traffic for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause the netstack process to unexpectedly restart, which could cause the device to stop processing network traffic or to reload. This vulnerability is due to lack of proper error checking when processing an ingress MPLS frame. An attacker could exploit this vulnerability by sending a crafted IPv6 packet that is encapsulated within an MPLS frame to an MPLS-enabled interface of the targeted device. A successful exploit could allow the attacker to cause a denial of service (DoS) condition. Note: The IPv6 packet can be generated multiple hops away from the targeted device and then encapsulated within MPLS. The DoS condition may occur when the NX-OS device processes the packet.

The weakness was disclosed 02/28/2024 as cisco-sa-ipv6-mpls-dos-R9ycXkwM. The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability is traded as CVE-2024-20267 since 11/08/2023. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 02/28/2024).

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• NX-OS

Version

• 6.0
• 6.2
• 7.0
• 7.1
• 7.2
• 7.3
• 9.2
• 9.3
• 10.1
• 10.2
• 10.3
• 10.4

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion