description: A vulnerability in the External Border Gateway Protocol (eBGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability exists because eBGP traffic is mapped to a shared hardware rate-limiter queue. An attacker could exploit this vulnerability by sending large amounts of network traffic with certain characteristics through an affected device. A successful exploit could allow the attacker to cause eBGP neighbor sessions to be dropped, leading to a DoS condition in the network.
problem types: Uncontrolled Resource Consumption
affected:
{
vendor: Cisco
product: Cisco NX-OS Software
versions:
version: 7.0(3)F1(1), status: affected
version: 7.0(3)F2(1), status: affected
version: 7.0(3)F2(2), status: affected
version: 7.0(3)F3(1), status: affected
version: 7.0(3)F3(2), status: affected
version: 7.0(3)F3(3), status: affected
version: 7.0(3)F3(3a), status: affected
version: 7.0(3)F3(4), status: affected
version: 7.0(3)F3(3c), status: affected
version: 7.0(3)F3(5), status: affected
version: 9.2(1), status: affected
version: 9.2(2), status: affected
version: 9.2(2t), status: affected
version: 9.2(3), status: affected
version: 9.2(4), status: affected
version: 9.2(2v), status: affected
version: 9.3(1), status: affected
version: 9.3(2), status: affected
version: 9.3(3), status: affected
version: 9.3(4), status: affected
version: 9.3(5), status: affected
version: 9.3(6), status: affected
version: 9.3(7), status: affected
version: 9.3(7a), status: affected
version: 9.3(8), status: affected
version: 9.3(9), status: affected
version: 9.3(10), status: affected
version: 9.3(11), status: affected
version: 9.3(12), status: affected
version: 10.1(1), status: affected
version: 10.1(2), status: affected
version: 10.1(2t), status: affected
version: 10.2(1), status: affected
version: 10.2(1q), status: affected
version: 10.2(2), status: affected
version: 10.2(3), status: affected
version: 10.2(3t), status: affected
version: 10.2(4), status: affected
version: 10.2(5), status: affected
version: 10.2(3v), status: affected
version: 10.2(6), status: affected
version: 10.3(1), status: affected
version: 10.3(2), status: affected
version: 10.3(3), status: affected
version: 10.3(99w), status: affected
version: 10.3(99x), status: affected
version: 10.3(4a), status: affected
version: 10.4(1), status: affected
}
metrics:
format: cvssV3_1
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
baseScore: 8.6
baseSeverity: HIGH
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
]
exploits: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.