Cisco NX-OS (VXLAN OAM / NGOAM): FABRIC DOS: a crafted VXLAN OAM packet reloads a VTEP

Impact

FABRIC DOS: a crafted VXLAN OAM packet reloads a VTEP. In a VXLAN/EVPN GPU fabric every leaf is a VTEP, so an attacker with a foothold in any tenant overlay can knock out leaves one at a time and stall collectives cluster-wide. Reachable from inside a tenant's own overlay, which is what makes it interesting — it does not need underlay access.

Who can reach it

Unauthenticated, remote — the attacker needs to be able to land a crafted VXLAN packet on the switch's VTEP address. In practice that means a compromised workload or a tenant that can source arbitrary UDP.

What to do

NX-OS upgrade plus reload. If NGOAM is not in use, disabling the feature is a live config change with no reload and removes the exposure entirely — do that first, patch on the next window.

References