Cisco NX-OS / FXOS (LLDP parser): A malformed LLDP frame reloads the switch. LLDP is enabled by default on essentially

Impact

A malformed LLDP frame reloads the switch. LLDP is enabled by default on essentially every fabric port and is unauthenticated by design, so any host on any port can drop its leaf. In a training cluster a single leaf reload takes out a whole rack of GPUs mid-job.

Who can reach it

Unauthenticated, adjacent — a single crafted frame from a directly connected host.

What to do

NX-OS upgrade plus reload. Interim: disable LLDP on tenant-facing ports. Note that if you use LLDP for cabling verification (common in GPU builds, to prove the rail-optimized topology is wired right) disabling it costs you that check, so most operators patch rather than disable.

References

Related entries

• Dell iDRAC7 / iDRAC8 / iDRAC9 (SNMP agent): Command injection in the iDRAC SNMP agent gives an attacker who alreadyCVE-2018-1244 · Dell iDRAC7 / iDRAC8 / iDRAC9 (SNMP agent)High
• Dell iDRAC9 (Redfish): Redfish interface permission-check flaw enabling privilege escalation to adminCVE-2018-15774 · Dell iDRAC9 (Redfish)High
• Intel AMT (HTTP handler) in Intel CSME firmware: A buffer overflow in AMT's HTTP handler allows arbitrary codeCVE-2018-3628 · Intel AMT (HTTP handler) in Intel CSME firmwareHigh
• Brocade Fabric OS Webtools (firmware update section): A remote authenticated attacker can abuse the WebtoolsCVE-2018-6442 · Brocade Fabric OS Webtools (firmware update section)High
• Eaton UPS 9PX 8000 SP administration panel: CSRF on the change-password function plus reflected XSS: an attacker forcesCVE-2018-9281 · Eaton UPS 9PX 8000 SP administration panelHigh
• Intel Ethernet 700 Series Controller firmware (X710/XL710/XXV710): Buffer overflow in the adapter firmware of Intel'sCVE-2019-0140 · Intel Ethernet 700 Series Controller firmware (X710/XL710/XXV710)High