Summary

• A vulnerability in the multicast traceroute version 2 (Mtrace2) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust the UDP packet memory of an affected device.

  This vulnerability exists because the Mtrace2 code does not properly handle packet memory. An attacker could exploit this vulnerability by sending crafted packets to an affected device. A successful exploit could allow the attacker to exhaust the incoming UDP packet memory. The affected device would not be able to process higher-level UDP-based protocols packets, possibly causing a denial of service (DoS) condition.

  Note: This vulnerability can be exploited using IPv4 or IPv6.

  Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pak-mem-exhst-3ke9FeFy

  This advisory is part of the September 2024 release of the Cisco IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2024 Semiannual Cisco IOS XR Software Security Advisory Bundled Publication.

Affected Products

• Vulnerable Products

  This vulnerability affects Cisco devices if they were running a vulnerable release of Cisco IOS XR Software and are processing Mtrace2 packets.

  Cisco IOS XR Software releases earlier than Release 7.7.1 are not affected.

  Cisco IOS XR Software releases 7.7.1 through 7.11.2 are affected if the multicast RPM Packet Manager (RPM) is installed and active on the device, regardless of any multicast configuration.

  Cisco IOS XR Software releases 24.1.1 and later are affected if the multicast RPM is installed and active and the device has a multicast configuration. If multicast is not configured, the device is not vulnerable.

  For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.

  Determine Whether the Multicast RPM is Active

  To determine whether the multicast RPM is active, use the show install active summary | include mcast command. If that command returns an empty output, the multicast RPM is not active.

  Determine Whether Mtrace2 Processing is Enabled

  To determine whether the device is processing Mtrace2 packets, use the show lpts pifib hardware entry brief location <LC> | include 33433 command and the show lpts pifib entry brief | include 33433 command to see if LPTS entries are created for the Mtrace2 port. If both commands return empty output, the device is not processing Mtrace2 packets.

  In the following examples, the device does create LPTS entries and will process Mtrace2 packets:

  RP/0/RP0/CPU0:Router#show lpts pifib hardware entry brief location 0/0/CPU0 | include 33433
  IPV4 any	any	any	0	17	33433	0	0	UDP-listen	Dlvr RP0	LOW	0	0	0-default
  IPV4 any	any	any	0	17	33433	0	1	UDP-listen	Dlvr RP0	LOW	0	0	0-default
  IPV4 any	any	any	0	17	33433	0	2	UDP-listen	Dlvr RP0	LOW	0	0	0-default
  IPV4 any	any	any	0	17	33433	0	0	UDP-listen	Dlvr RP0	LOW	0	0	0-default
  IPV4 any	any	any	0	17	33433	0	1	UDP-listen	Dlvr RP0	LOW	0	0	0-default
  IPV4 any	any	any	0	17	33433	0	2	UDP-listen	Dlvr RP0	LOW	0	0	0-default
  RP/0/RP0/CPU0:Router#

    RP/0/RP0/CPU0:Router# show lpts pifib entry brief | include 33433
    IPv4       default  UDP    any          0/RP0/CPU0                   any,33433 any
    IPv6       default  UDP    any          0/RP0/CPU0                   any,33433 any
  

  Note: Mtrace2 on Cisco IOS XR Software uses the non-standard port 33433 instead of the standard RFC port of 33435.

  Products Confirmed Not Vulnerable

  Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.

  Cisco has confirmed that this vulnerability does not affect the following Cisco products:

  • IOS Software
  • IOS XE Software
  • NX-OS Software

Details

• The show packet memory command can be used to verify the number of packets that are currently held in the packet memory, as shown in the following example:

  RP/0/RP0/CPU0:#show packet-memory summary
   ProcId JobId Count Percentage Process
     4916   328     9      0.18% tcp
     4512  1241  1125     22.46% igmp
     4527  1246  3875     77.36% mld

  During normal operations, the packet count should be low. If the packet count for the mld process or the igmp process steadily increases or never decreases over several runs of that command, the device is affected by this vulnerability.

Workarounds

• There are no workarounds that address this vulnerability. However, there are mitigations for this vulnerability.

  Deactivate the RPM on Cisco IOS XR Releases 7.7 to 7.11

  If the device does not need the multicast configuration, deactivate and remove the multicast RPM. This will close the vulnerable UDP port.

  In this example, the multicast package asr9k-mcast-x64-2.0.0.0-r7921.x86_64.rpm is deactivated:

  Router# show install active summary | include mcast
  
  asr9k-mcast-x64-2.0.0.0-r7921.x86_64.rpm
  
  Router# install deactivate asr9k-mcast-x64-2.0.0.0-r7921.x86_64.rpm synchronous
  
  Router# install commit

  Use an Infrastructure Access Control List (iACLs) to Block Port 33433

  To protect infrastructure devices and minimize the risk, impact, and effectiveness of direct infrastructure attacks, administrators are advised to deploy iACLs to enforce policies on traffic that is sent to infrastructure equipment. Administrators can construct an iACL by explicitly permitting only authorized traffic that is sent to infrastructure devices in accordance with existing security policies and configurations. For the maximum protection of infrastructure devices, deployed iACLs should be applied in the ingress direction on all interfaces to which an IP address has been configured. An iACL mitigation cannot completely protect against this vulnerability when the attack originates from a trusted source address.

  The iACL policy denies unauthorized Mtrace2 communications packets that are sent to UDP port 33433 on affected devices. In the following example, 192.168.60.0/24 is the IP address space that is used by the affected devices. Care should be taken to allow required traffic for routing and administrative access before denying all unauthorized traffic. Whenever possible, infrastructure address space should be distinct from the address space for user and services segments. Using this addressing methodology will assist with the construction and deployment of iACLs.

  Note: Mtrace2 also supports IPv6, so a corresponding IPv6 iACL is required if the device has IPv6 configured.

  Note: Cisco uses UDP port 33433, not 33435, for Mtrace2.

  ipv4 access-list Infrastructure-ACL-Policy  
  !  
  !-- The following vulnerability-specific access control entries  
  !-- (ACEs) can drop Mtrace version 2 communication packets  
  !  deny udp any 192.168.60.0 0.0.0.255 eq 33433 
  !  
  !-- Explicit deny ACE for traffic sent to addresses configured  
  !-- within the infrastructure address space  
  !  deny ip any 192.168.60.0 0.0.0.255
  ! 
  !-- Permit or deny all other Layer 3 and Layer 4 traffic in 
  !-- accordance with existing security policies and configurations 
  ! 
  !-- Apply iACL to interfaces in the ingress direction 
  !
  interface GigabitEthernet0/0 ipv4 access-group Infrastructure-ACL-Policy in
  
  

  For additional information about iACLs, see Protecting Your Core: Infrastructure Protection Access Control Lists.

  Restart IGMP and MLD Processes

  Restarting the Internet Group Management Protocol (IGMP) process or the Multicast Listener Discovery (MLD) process, or both processes, before the device runs out of memory can ensure that other processes will not be affected. (See the Details section for more information.) Restarting these processes does not prevent the device from leaking UDP memory.

  Use the process restart mld or process restart igmp command to restart the respective processes.

  While these mitigations have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

Fixed Software

• Cisco has released free software updates that address the vulnerability described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels.

  Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:
  https://www.cisco.com/c/en/us/products/end-user-license-agreement.html

  Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.

  The Cisco Support and Downloads page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool.

  When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.

  In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.

  Customers Without Service Contracts

  Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html

  Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.

  Fixed Releases

  In the following table, the left column lists Cisco software releases or trains. The right column indicates whether a release (train) is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability.

  Cisco IOS XR Software Release	First Fixed Release
  7.6 and earlier	Not affected.
  7.7 to 7.10	Migrate to a fixed release.
  7.11	7.11.21 (Oct 2024)
  24.1	Migrate to a fixed release.
  24.2	24.2.2 (Sep 2024)
  24.3.1 and later	Not affected.

  Cisco has released the following umbrella SMUs to address this vulnerability. Customers who require SMUs for releases that are not listed in the following table are advised to contact their support organization.

  Cisco IOS XR Software Release	Platform	SMU Name
  7.7.2	IOSXRWBD	iosxrwbd-7.7.2.CSCwm05729
  7.11.2	IOSXRWBD NCS5500	iosxrwbd-7.11.2.CSCwm05729 ncs5500-7.11.2.CSCwm05729
  24.1.2	8000 Series	8000-24.1.2.CSCwm05729

  The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.

Exploitation and Public Announcements

• The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Source

• This vulnerability was found during the resolution of a Cisco TAC support case.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pak-mem-exhst-3ke9FeFy

Revision History

• Version	Description	Section	Status	Date
  1.0	Initial public release.	—	Final	2024-SEP-11

  Show Less

---