Vulnerability · Published Jan 10, 2025 · Assigned by Arista
CVE-2024-6437On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options ma
Medium 5.8
In plain English
A medium-severity security flaw in EOS - BGP Flowspec from Arista Networks. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Official description
On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options may bypass the feature's set nexthop action and be slow-path forwarded (FIB routed) by the kernel as the packets are trapped to the CPU instead of following the redirect action's destination.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Arista Networks | EOS-Policy Based Routing (PBR) | 4.32.0F – through 4.32.1F4.31.0M – through 4.31.4M4.30.0M – through 4.30.7M4.29.0M – through 4.29.9M4.28.0M – through 4.28.11M4.27.0M – through 4.27.12M4.26.0M – through 4.26.14M4.25.0M – through 4.25.11M |
| Arista Networks | EOS - BGP Flowspec | 4.32.0F – through 4.32.1F4.31.0M – through 4.31.4M4.30.0M – through 4.30.7M4.29.0M – through 4.29.9M4.28.0M – through 4.28.11M4.27.0M – through 4.27.12M4.26.0M – through 4.26.14M4.25.0M – through 4.25.11M |
| Arista Networks | EOS - Interface Traffic Policy | 4.32.0F – through 4.32.1F4.31.0M – through 4.31.4M4.30.0M – through 4.30.7M4.29.0M – through 4.29.9M4.28.0M – through 4.28.11M4.27.2F – through 4.27.12F |