CVE-2024-20304

A vulnerability in the multicast traceroute version 2 (Mtrace2) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust the UDP packet memory of an affected device. This vulnerability exists because the Mtrace2 code does not properly handle packet memory. An attacker could exploit this vulnerability by sending crafted packets to an affected device. A successful exploit could allow the attacker to exhaust the incoming UDP packet memory. The affected device would not be able to process higher-level UDP-based protocols packets, possibly causing a denial of service (DoS) condition. Note: This vulnerability can be exploited using IPv4 or IPv6.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pak-mem-exhst-3ke9FeFy	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:cisco:ios_xr:7.7.1:::::::*
	cpe:2.3:o:cisco:ios_xr:7.7.2:::::::*
	cpe:2.3:o:cisco:ios_xr:7.7.21:::::::*
	cpe:2.3:o:cisco:ios_xr:7.8.1:::::::*
	cpe:2.3:o:cisco:ios_xr:7.8.2:::::::*
	cpe:2.3:o:cisco:ios_xr:7.8.12:::::::*
	cpe:2.3:o:cisco:ios_xr:7.8.22:::::::*
	cpe:2.3:o:cisco:ios_xr:7.9.1:::::::*
	cpe:2.3:o:cisco:ios_xr:7.9.2:::::::*
	cpe:2.3:o:cisco:ios_xr:7.9.21:::::::*
	cpe:2.3:o:cisco:ios_xr:7.10.1:::::::*
	cpe:2.3:o:cisco:ios_xr:7.10.2:::::::*
	cpe:2.3:o:cisco:ios_xr:7.11.1:::::::*
	cpe:2.3:o:cisco:ios_xr:7.11.2:::::::*
	cpe:2.3:o:cisco:ios_xr:24.1.1:::::::*
	cpe:2.3:o:cisco:ios_xr:24.1.2:::::::*
	cpe:2.3:o:cisco:ios_xr:24.2.1:::::::*
	cpe:2.3:o:cisco:ios_xr:24.2.11:::::::*

History

No history.

Information

Published : 2024-09-11 17:15

Updated : 2024-10-03 14:20

NVD link : CVE-2024-20304

Mitre link : CVE-2024-20304

CVE.ORG link : CVE-2024-20304

JSON object : View

Products Affected

cisco

ios_xr

CWE

CWE-401

Missing Release of Memory after Effective Lifetime

{"id": "CVE-2024-20304", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-09-11T17:15:11.853", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pak-mem-exhst-3ke9FeFy", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-401"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the multicast traceroute version 2 (Mtrace2) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust the UDP packet memory of an affected device.\r\n\r\nThis vulnerability exists because the Mtrace2 code does not properly handle packet memory. An attacker could exploit this vulnerability by sending crafted packets to an affected device. A successful exploit could allow the attacker to exhaust the incoming UDP packet memory. The affected device would not be able to process higher-level UDP-based protocols packets, possibly causing a denial of service (DoS) condition.\r\nNote: This vulnerability can be exploited using IPv4 or IPv6."}, {"lang": "es", "value": "Una vulnerabilidad en la funci\u00f3n multicast traceroute versi\u00f3n 2 (Mtrace2) del software Cisco IOS XR podr\u00eda permitir que un atacante remoto no autenticado agote la memoria de paquetes UDP de un dispositivo afectado. Esta vulnerabilidad existe porque el c\u00f3digo Mtrace2 no maneja correctamente la memoria de paquetes. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando paquetes manipulados a un dispositivo afectado. Una explotaci\u00f3n exitosa podr\u00eda permitir que el atacante agote la memoria de paquetes UDP entrantes. El dispositivo afectado no podr\u00eda procesar paquetes de protocolos basados en UDP de nivel superior, lo que posiblemente provoque una condici\u00f3n de denegaci\u00f3n de servicio (DoS). Nota: Esta vulnerabilidad se puede aprovechar utilizando IPv4 o IPv6."}], "lastModified": "2024-10-03T14:20:07.680", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xr:7.7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1807BE16-BAA9-4BC6-B98A-13D584A12821"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:7.7.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "375746CB-695E-4019-89C9-42ED37A5E958"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:7.7.21:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE7D05C0-4065-448B-AAC6-F29E379F3DA6"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:7.8.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D8ADA2B1-FD5A-4900-953B-30951C8EF9AE"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:7.8.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B4C7223-3EFB-48C2-BE22-941F60826D0C"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:7.8.12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A14959D-63E1-4B5A-BB7F-A9A2AF3F1137"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:7.8.22:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EE83701-C0B7-4ED2-866B-44B7F54FCA0F"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:7.9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "164B241C-397A-4921-BC5B-F928A21E91C2"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:7.9.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FAD3875D-D283-4961-BE31-750FDF9CDF56"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:7.9.21:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87EF9DC5-4BE2-429D-B9BA-EF9F29E7E0F7"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:7.10.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BAEC28C0-8091-49F9-88D1-CB96234BF52A"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:7.10.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1ED2B72-A65C-47E4-87B3-D83F29428396"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:7.11.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8904CAA5-4E01-462C-AE57-067902CD95FC"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:7.11.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7750EA99-EC55-4F94-8730-18583647BBBA"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:24.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BCE8E968-111F-4F57-93D3-E509AB540B87"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:24.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B342A550-8600-45CF-8B9A-530770C9A0F4"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:24.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D64E1C4D-46B0-4A18-B8EE-BEA732CBF1F8"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:24.2.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "11288A28-F0CF-4FEC-A0B7-3D93866F01FE"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}