.webp)
Major Cisco IOS XR vulnerability threatens network stability by enabling remote attackers to exhaust UDP packet memory
A severe vulnerability in Cisco IOS XR Software poses significant threats to network stability and security. This flaw, related to the multicast traceroute version 2 (Mtrace2) feature, enables unauthenticated, remote attackers to exhaust UDP packet memory. Such exploitation can lead to a denial of service (DoS) and even privilege escalation.
The vulnerability arises from the Mtrace2 code’s improper handling of packet memory. Attackers can exploit this flaw by sending specially crafted packets that deplete the device’s UDP memory. This prevents the device from processing higher-level UDP packets, resulting in a DoS condition. The issue affects both IPv4 and IPv6 protocols.
Specifically, several CVEs detail the scope of the problem: CVE-2024-20304, CVE-2024-20317, CVE-2024-20406, and CVE-2024-20398 all highlight variations of this vulnerability, each allowing unauthenticated, adjacent attackers to cause critical priority packets to be dropped, leading to DoS conditions.
Cisco IOS XR releases from 7.7.1 through 7.11.2, and 24.1.1 and later, are vulnerable if the multicast RPM Packet Manager is active. Devices running earlier versions are not affected. Administrators should verify if the multicast RPM is active using specific commands and apply Cisco’s free software updates promptly to address this vulnerability.
To mitigate the risk, administrators are advised to deactivate the Multicast RPM if not needed and consider implementing Infrastructure Access Control Lists (iACLs) to enforce traffic policies. Customers with service contracts should obtain updates through their usual channels, while those without should contact Cisco Technical Assistance Center (TAC). Immediate action is crucial to safeguard network infrastructure against potential exploits.
.webp)
.webp)
