title: On affected platforms running Arista CloudEOS a size check bypass issue in the Software Forwarding Engine (Sfe) may allow buffer over reads in later code. Additionally, depending on configured options this may cause a recomputation of the TCP checksum ...
description: On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch. This causes a leak of packet buffers and if enough malformed packets are received, the switch may eventually stop forwarding traffic.
problem types: CWE-126 Buffer Over-read
affected:
{
vendor: Arista Networks
product: EOS
versions:
version: 4.29.0, status: affected, lessThanOrEqual: 4.29.1F, versionType: custom
version: 4.28.0, status: affected, lessThanOrEqual: 4.28.5M, versionType: custom
version: 4.27.0, status: affected, lessThanOrEqual: 4.27.8M, versionType: custom
version: 4.26.0, status: affected, lessThanOrEqual: 4.26.9M, versionType: custom
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
]
solutions: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Artista recommends customers move to the latest version of each release that contains all the fixes listed below.
CVE-2023-24513 has been fixed in the following releases:
4.29.2F and later releases in the 4.29.x train
4.28.6M and later releases in the 4.28.x train
4.27.9M and later releases in the 4.27.x train
4.26.10M and later releases in the 4.26.x train
workarounds: There is no mitigation / workaround for these issues.