Database/Firmware, BMC & network fabric
Arista EOS (PBR / BGP Flowspec / interface traffic policy): TENANT ISOLATION: IPv4 packets carrying IP options can
Impact
TENANT ISOLATION: IPv4 packets carrying IP options can bypass policy-based routing, BGP Flowspec and interface traffic policy redirection. If you use PBR or Flowspec to steer a tenant's traffic through an inspection or scrubbing path, an attacker sets an IP option and goes around it. Flowspec-based DDoS mitigation on the cluster edge fails the same way.
Who can reach it
Any sender able to emit IPv4 packets with IP options toward an interface with the affected redirection configured.
What to do
EOS upgrade plus reload. Interim: drop IPv4 packets with IP options at the edge with an ACL — a live config change, and reasonable policy in a datacenter fabric where IP options have no legitimate use.
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.