Arista EOS: malformed packets crash the IGMP snooping agent and flood multicast to the whole VLAN

Impact

An unauthenticated device on an affected VLAN can send malformed packets that terminate the IGMP snooping agent. While it is down, multicast that was being constrained to subscribed ports floods every port in the VLAN, and repeated exploitation keeps it that way. On a datacenter fabric this is a bandwidth and isolation problem at once: multicast intended for a subset of nodes reaches every host on the VLAN, and the added load lands on links that GPU nodes share for storage and management traffic. IGMP snooping is enabled by default on all VLANs, so affected switches are exposed unless it was deliberately turned off.

Who can reach it

Network-adjacent and unauthenticated - any host or tenant VM with a port on an affected VLAN. No credentials on the switch are needed.

What to do

Apply the fixed EOS release or hotfix listed in Arista advisory 0159. The advisory is the authority on which releases carry the fix; plan for the switch to be taken through an upgrade, which for a leaf switch means the GPU racks behind it lose their uplinks unless they are dual-homed. Disabling IGMP snooping on VLANs that do not need it removes the exposure but gives up the multicast constraint itself.

References

Related entries

• Arista EOS: crafted packet expires multicast forwarding state early, dropping multicast trafficCVE-2026-73468 · Arista EOS multicast forwarding stateHigh
• HPE iLO 4 / iLO 5 (remote buffer overflow): Remotely triggerable buffer overflow in the iLO firmware on both the Gen9CVE-2019-11983 · HPE iLO 4 / iLO 5 (remote buffer overflow)High
• Insyde InsydeH2O (PnpSmm shared SMM/non-SMM buffer, DMA TOCTOU): A buffer shared between SMM and non-SMM codeCVE-2022-32469 · Insyde InsydeH2O (PnpSmm shared SMM/non-SMM buffer, DMA TOCTOU)High
• Insyde InsydeH2O (FwBlockServiceSmm shared buffer, DMA TOCTOU): The firmware block service's shared buffer is racy, soCVE-2022-32470 · Insyde InsydeH2O (FwBlockServiceSmm shared buffer, DMA TOCTOU)High
• Insyde InsydeH2O (IhisiSmm / IhisiDxe command buffer): One representative of a family of roughly a dozen InsydeCVE-2022-32471 · Insyde InsydeH2O (IhisiSmm / IhisiDxe command buffer)High
• Insyde InsydeH2O (HddPassword shared buffer, DMA TOCTOU): Racy shared buffer in the ATA security driverCVE-2022-32473 · Insyde InsydeH2O (HddPassword shared buffer, DMA TOCTOU)High