Database/Firmware, BMC & network fabric
Arista EOS BFD: crafted packet to an authenticated BFD session reboots the switch
Impact
An unauthenticated attacker can send a crafted BFD packet to an interface running BFD with keyed MD5 or keyed SHA1 authentication and reboot the switch. BFD is widely used to detect link failures fast in BGP-routed GPU fabrics, so this can turn into unplanned reboots of leaf or spine switches and break jobs on every node behind them. The record describes availability impact only.
Who can reach it
Unauthenticated, with network adjacency to a BFD-enabled interface, either directly or multi-hop. This applies only where BFD uses keyed MD5 or keyed SHA1 authentication.
What to do
Upgrade EOS to the fixed release listed in Arista Security Advisory 0206. The record does not give the fixed versions. A switch image upgrade means draining traffic off each device in turn. Switches whose BFD sessions do not use keyed MD5 or SHA1 authentication are outside the stated conditions.
References
Related entries
- go-attestation: crafted TPM event log injects trusted SHA256 hashes, so a verifier accepts a compromised bootCVE-2026-12681 · Google go-attestation (parseEfiSignatureList, TPM event log verification)High
- Arista EOS OSPFv3: crafted packet restarts the routing agentCVE-2026-73455 · Arista EOS (OSPFv3 routing agent)High
- Linux kernel InfiniBand uverbs (ib_uverbs / ib_umem_get, drivers/infiniband/core/umem.c): The canonical RDMA isolationCVE-2014-8159 · Linux kernel InfiniBand uverbs (ib_uverbs / ib_umem_get, drivers/infiniband/core/umem.c)High
- Dell iDRAC7 / iDRAC8 firmware before 2.40.40.40 - racadm CLI string injection: A string injection escapes theCVE-2016-5685 · Dell iDRAC7 / iDRAC8 firmware before 2.40.40.40 - racadm CLI string injectionHigh
- Cisco NX-OS / FXOS (LLDP parser): A malformed LLDP frame reloads the switch. LLDP is enabled by default on essentiallyCVE-2018-0395 · Cisco NX-OS / FXOS (LLDP parser)High
- Dell iDRAC7 / iDRAC8 / iDRAC9 (SNMP agent): Command injection in the iDRAC SNMP agent gives an attacker who alreadyCVE-2018-1244 · Dell iDRAC7 / iDRAC8 / iDRAC9 (SNMP agent)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.