Vulnerability in Cisco IOS XR Software Could Lead to UDP Packet Memory Exhaustion and DoS Conditions
CVE-2024-20304

7.5HIGH

Key Information:

Vendor
Cisco
Status
Cisco iOS Xr Software
Vendor
CVE Published:
11 September 2024

Summary

A vulnerability exists within the multicast traceroute version 2 (Mtrace2) feature of Cisco IOS XR Software, allowing unauthenticated remote attackers to exploit the device's UDP packet memory management. The flawed handling of packets can lead to memory exhaustion, preventing the device from processing additional UDP packets. This disruption could result in a denial of service condition, compromising the device's performance and its ability to handle more complex UDP-based protocol packets. The vulnerability can be triggered through crafted packets sent via both IPv4 and IPv6 protocols.

Affected Version(s)

Cisco IOS XR Software 7.8.1

Cisco IOS XR Software 7.8.12

Cisco IOS XR Software 7.7.1

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.