Arista EOS: crafted packet expires multicast forwarding state early, dropping multicast traffic

Impact

A specially crafted packet causes multicast forwarding state on affected interfaces to expire before it should, so multicast traffic is lost until the state is rebuilt. Arista's description is brief and does not name the protocol or the packet, so the exposure should be read as what it says: an availability hit to multicast forwarding, not a path to the switch. Where multicast carries cluster discovery, storage heartbeats or telemetry between GPU nodes, an intermittent drop shows up as job-level failures that are hard to attribute to the fabric. This is a different defect from the IGMP snooping agent crash in advisory 0159 and carries its own advisory.

Who can reach it

Network-adjacent and unauthenticated per the CVSS vector (AV:A) - a host able to send traffic onto an affected interface. Authentication on the switch is not required.

What to do

Follow Arista advisory 0175 for the affected platforms and fixed EOS releases. The advisory does not, in the record here, name a configuration workaround, so plan an EOS upgrade on affected switches and schedule it against the racks those switches feed.

References

Related entries

• HPE iLO 4 / iLO 5 (remote buffer overflow): Remotely triggerable buffer overflow in the iLO firmware on both the Gen9CVE-2019-11983 · HPE iLO 4 / iLO 5 (remote buffer overflow)High
• Insyde InsydeH2O (PnpSmm shared SMM/non-SMM buffer, DMA TOCTOU): A buffer shared between SMM and non-SMM codeCVE-2022-32469 · Insyde InsydeH2O (PnpSmm shared SMM/non-SMM buffer, DMA TOCTOU)High
• Insyde InsydeH2O (FwBlockServiceSmm shared buffer, DMA TOCTOU): The firmware block service's shared buffer is racy, soCVE-2022-32470 · Insyde InsydeH2O (FwBlockServiceSmm shared buffer, DMA TOCTOU)High
• Insyde InsydeH2O (IhisiSmm / IhisiDxe command buffer): One representative of a family of roughly a dozen InsydeCVE-2022-32471 · Insyde InsydeH2O (IhisiSmm / IhisiDxe command buffer)High
• Insyde InsydeH2O (HddPassword shared buffer, DMA TOCTOU): Racy shared buffer in the ATA security driverCVE-2022-32473 · Insyde InsydeH2O (HddPassword shared buffer, DMA TOCTOU)High
• Insyde InsydeH2O (StorageSecurityCommandDxe shared buffer, DMA TOCTOU): The TCG/Opal security-command driver sharesCVE-2022-32474 · Insyde InsydeH2O (StorageSecurityCommandDxe shared buffer, DMA TOCTOU)High