CVE-2023-24511

Exploit

EPSS 0.03%
Published 12.04.2023 21:15:16
Last modified 21.11.2024 07:48:01
Source psirt@arista.com
Teams watchlist Login
Open Login

On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process. This may result in the snmpd processing being terminated (causing SNMP requests to time out until snmpd is automatically restarted) and potential memory resource exhaustion for other processes on the switch. The vulnerability does not have any confidentiality or integrity impacts to the system.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Arista ≫ Eos Version >= 4.26.0 < 4.26.10m

   Arista ≫ Ceos-lab Version-
   Arista ≫ Cloudeos Version-
   Arista ≫ Veos-lab Version-
   Arista ≫ 7010t Version-
   Arista ≫ 7010t-48 Version-
   Arista ≫ 7010tx-48 Version-
   Arista ≫ 7010tx-48-dc Version-
   Arista ≫ 7020sr-24c2 Version-
   Arista ≫ 7020sr-32c2 Version-
   Arista ≫ 7020tr-48 Version-
   Arista ≫ 7020tra-48 Version-
   Arista ≫ 7050cx3-32s Version-
   Arista ≫ 7050cx3m-32s Version-
   Arista ≫ 7050qx-32s Version-
   Arista ≫ 7050qx2-32s Version-
   Arista ≫ 7050sx-128 Version-
   Arista ≫ 7050sx-64 Version-
   Arista ≫ 7050sx-72q Version-
   Arista ≫ 7050sx2-128 Version-
   Arista ≫ 7050sx2-72q Version-
   Arista ≫ 7050sx3-48c8 Version-
   Arista ≫ 7050sx3-48yc Version-
   Arista ≫ 7050sx3-48yc12 Version-
   Arista ≫ 7050sx3-48yc8 Version-
   Arista ≫ 7050sx3-96yc8 Version-
   Arista ≫ 7050tx-48 Version-
   Arista ≫ 7050tx-64 Version-
   Arista ≫ 7050tx-72q Version-
   Arista ≫ 7050tx2-128 Version-
   Arista ≫ 7050tx3-48c8 Version-
   Arista ≫ 7060cx-32s Version-
   Arista ≫ 7060cx2-32s Version-
   Arista ≫ 7060dx4-32 Version-
   Arista ≫ 7060px4-32 Version-
   Arista ≫ 7060sx2-48yc6 Version-
   Arista ≫ 7150s-24 Version-
   Arista ≫ 7150s-52 Version-
   Arista ≫ 7150s-64 Version-
   Arista ≫ 7150sc-24 Version-
   Arista ≫ 7150sc-64 Version-
   Arista ≫ 7160-32cq Version-
   Arista ≫ 7160-48tc6 Version-
   Arista ≫ 7160-48yc6 Version-
   Arista ≫ 7170-32c Version-
   Arista ≫ 7170-32cd Version-
   Arista ≫ 7170-64c Version-
   Arista ≫ 7170b-64c Version-
   Arista ≫ 720df-48y Version-
   Arista ≫ 720dp-24s Version-
   Arista ≫ 720dp-48s Version-
   Arista ≫ 720dt-24s Version-
   Arista ≫ 720dt-48s Version-
   Arista ≫ 720dt-48y Version-
   Arista ≫ 720xp-24y6 Version-
   Arista ≫ 720xp-24zy4 Version-
   Arista ≫ 720xp-48y6 Version-
   Arista ≫ 720xp-48zc2 Version-
   Arista ≫ 720xp-96zc2 Version-
   Arista ≫ 722xpm-48y4 Version-
   Arista ≫ 722xpm-48zy8 Version-
   Arista ≫ 7250qx-64 Version-
   Arista ≫ 7260cx Version-
   Arista ≫ 7260cx3 Version-
   Arista ≫ 7260cx3-64 Version-
   Arista ≫ 7260qx Version-
   Arista ≫ 7260qx-64 Version-
   Arista ≫ 7280cr2ak-30 Version-
   Arista ≫ 7280cr2k-60 Version-
   Arista ≫ 7280cr3-32d4 Version-
   Arista ≫ 7280cr3-32p4 Version-
   Arista ≫ 7280cr3-96 Version-
   Arista ≫ 7280cr3k-32d4 Version-
   Arista ≫ 7280cr3k-32p4 Version-
   Arista ≫ 7280cr3k-96 Version-
   Arista ≫ 7280dr3-24 Version-
   Arista ≫ 7280dr3k-24 Version-
   Arista ≫ 7280e Version-
   Arista ≫ 7280pr3-24 Version-
   Arista ≫ 7280pr3k-24 Version-
   Arista ≫ 7280r Version-
   Arista ≫ 7280r2 Version-
   Arista ≫ 7280r3 Version-
   Arista ≫ 7280sr3-48yc8 Version-
   Arista ≫ 7280sr3k-48yc8 Version-
   Arista ≫ 7300x-32q Version-
   Arista ≫ 7300x-64s Version-
   Arista ≫ 7300x-64t Version-
   Arista ≫ 7300x3-32c Version-
   Arista ≫ 7300x3-48yc4 Version-
   Arista ≫ 7304 Version-
   Arista ≫ 7308 Version-
   Arista ≫ 7316 Version-
   Arista ≫ 7320x-32c Version-
   Arista ≫ 7368x4 Version-
   Arista ≫ 7388x5 Version-
   Arista ≫ 7500e Version-
   Arista ≫ 7500r Version-
   Arista ≫ 7500r2 Version-
   Arista ≫ 7500r3 Version-
   Arista ≫ 7500r3-24d Version-
   Arista ≫ 7500r3-24p Version-
   Arista ≫ 7500r3-36cq Version-
   Arista ≫ 7500r3k-36cq Version-
   Arista ≫ 7800r3-36p Version-
   Arista ≫ 7800r3-48cq Version-
   Arista ≫ 7800r3k-48cq Version-
   Arista ≫ Ccs-750x-48thp Version-
   Arista ≫ Ccs-750x-48tp Version-
   Arista ≫ Ccs-750x-48zp Version-
   Arista ≫ Ccs-750x-48zxp Version-

Arista ≫ Eos Version >= 4.27.0 < 4.27.9m

Arista ≫ Eos Version >= 4.28.0 < 4.28.6m

Arista ≫ Eos Version >= 4.29.0 < 4.29.2f

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.03%	0.082

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
psirt@arista.com	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

https://www.arista.com/en/support/advisories-notices/security-advisory/17239-security-advisory-0084

Patch

Vendor Advisory

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2023-24511

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-24511

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-24511

EUVD