Arista EOS: DHCP relay forwards replies from unconfigured servers, allowing client config spoofing

Impact

The relay agent forwards DHCP replies to clients without checking that the reply came from a configured helper address. Anyone who can send packets to the relay can hand hosts a rogue default gateway, DNS server or boot parameters. On a datacenter fabric this is a path to intercepting traffic from freshly provisioned nodes, and where PXE or network boot is involved it influences what a node loads at boot - which is a much worse outcome than plain interception. The scoped-impact metrics in the vector reflect that the damage lands on the client hosts, not on the switch itself.

Who can reach it

Unauthenticated attacker with network access able to send a crafted DHCP reply to the relay agent; no credentials and no management-plane access needed.

What to do

Upgrade to the EOS release or hotfix identified in Arista security advisory 0156 - the record does not name a fixed version. Pending that, DHCP snooping and port-level filtering that drops server-side DHCP traffic from non-server ports limits who can inject replies. Fixing this means a switch maintenance window on every relay-configured switch.

References

Related entries

• RNIC on-board SRAM metadata cache (page table entries, QP context) - most widely deployed RDMA NIC: RNICs cacheNCVD-2019-003-rnic-on-board-sram-metadata-cach · RNIC on-board SRAM metadata cache (page table entries, QP context) - most widely deployed RDMA NICMedium
• RNIC on-board SRAM metadata cache (page table entries, QP context) - most widely deployed RDMA NIC: RNICs cacheNCVD-2019-006-rnic-on-board-sram-metadata-cach · RNIC on-board SRAM metadata cache (page table entries, QP context) - most widely deployed RDMA NICMedium
• RoCEv2 congestion control - DCQCN, ECN marking and Congestion Notification Packets: DCQCN reacts to ECN marks by havingNCVD-2022-003-rocev2-congestion-control-dcqcn · RoCEv2 congestion control - DCQCN, ECN marking and Congestion Notification PacketsMedium
• RNIC microarchitectural resources (NIC cache, processing units) under multi-tenant RDMA: This is the paper thatNCVD-2023-006-rnic-microarchitectural-resource · RNIC microarchitectural resources (NIC cache, processing units) under multi-tenant RDMAMedium
• RNIC microarchitectural resources (NIC cache, processing units) under multi-tenant RDMA: This is the paper thatNCVD-2023-008-rnic-microarchitectural-resource · RNIC microarchitectural resources (NIC cache, processing units) under multi-tenant RDMAMedium
• TPM 2.0 (S3 sleep PCR reset): Platform Configuration Registers can be reset without a full platform restart by abusingCVE-2018-6622 · TPM 2.0 (S3 sleep PCR reset)Medium