CVE-2024-6437

Solution:

• The recommended resolution is to upgrade to a remediated software version that contains the ip software forwarding options action drop CLI command, and configure the command at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2024-6437 has been fixed in the following releases: * 4.32.2F and later releases in the 4.32.x train * 4.31.5M and later releases in the 4.31.x train * 4.30.8M and later releases in the 4.30.x train * 4.29.10M and later releases in the 4.29.x train

Workaround:

• For all affected systems, the suggested mitigation for all three affected features is to drop all IPv4 options traffic via the ip software forwarding options action drop, available in 4.32.2F and later releases in the 4.32 train, 4.31.5M and later releases in the 4.31 train, and 4.30.8M and later releases in the 4.30 train. The command installs an iptables rule that drops all IPv4 options traffic in the filter table of the FORWARD chain. switch(config)#ip software forwarding options action drop # Below is shown to illustrate what the rule does. This is not a command that needs to be run. switch(config)#bash sudo iptables -vnL EOS_FORWARD Chain EOS_FORWARD (1 references)  pkts bytes target     prot opt in     out     source               destination     0     0 DROP       all -- *     *       0.0.0.0/0           0.0.0.0/0           u32 ! "0x0>>0x18=0x45"     0     0 REJECT     all -- *     fwd+   0.0.0.0/0           0.0.0.0/0           u32 ! "0x0>>0x18=0x45" reject-with icmp-admin-prohibited     0     0 DROP       all -- *     ma+     0.0.0.0/0           0.0.0.0/0     0     0 ACCEPT     all -- *     *     !127.0.0.0/8         !127.0.0.0/8   Additionally, in 7280R3, 7500R3, and 7800R3 systems, the system-rule overriding-action redirect command (present in EOS-4.28.0F and newer releases) can be used to allow for all of the affected features' set nexthop action to take precedence over the system ACL's trap action to CPU. See TCAM redirect action overriding system rules - TOI https://www.arista.com/en/support/toi/eos-4-28-0f/15280-tcam-redirect-action-overriding-system-rules  for more information.