title: On affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the configured ACL for a port resulting in some packets that should be denied being permitted and some
description: On affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the configured ACL for a port resulting in some packets that should be denied being permitted and some
problem types: CWE-283
affected:
{
defaultStatus: unaffected
modules: MultiAccess FPGA Software
product: MOS
vendor: Arista Networks
versions:
status: affected, version: 1.7.1
status: affected, version: 1.6
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
exploits: This issue was discovered internally and Arista is not aware of any malicious uses of this issue in customer networks.
solutions: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.
CVE-2023-6068 has been fixed in the following releases:
*  MultiAccess FPGA 1.8.0 and later
workarounds: The workaround is to only apply one access-list to any particular port after the MultiAccess image is loaded into the FPGA. If a new access-list is to be applied to a port, the FPGA image should be reloaded after the access-list is applied.
Run the following commands to reload the FPGA image, where the line in yellow represents new access control lists to be added:
switch(config-app-multiaccess)#shut
switch(config-app-multiaccess)#multiaccess-group 0 client 0 access-list new_acl_if_need
switch(config-app-multiaccess)#no shut
The previous applied access control lists will automatically apply after FPGA reload.