Cisco FXOS and NX-OS Software Link Layer Discovery Protocol Denial of Service Vulnerability

Available Languages

Updated:February 28, 2024
Document ID:1709136684971802

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Cisco Security Advisory

Cisco FXOS and NX-OS Software Link Layer Discovery Protocol Denial of Service Vulnerability

Medium
Advisory ID:
cisco-sa-nxos-lldp-dos-z7PncTgt
First Published:
2024 February 28 16:00 GMT
Version 1.0:
Final
Workarounds:
No workarounds available
CVE-2024-20294
CWE-805
CVSS Score:
Base 6.6Click Icon to Copy Verbose Score
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H/E:X/RL:X/RC:X
CVE-2024-20294
CWE-805

Summary

  • A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device.

    This vulnerability is due to improper handling of specific fields in an LLDP frame. An attacker could exploit this vulnerability by sending a crafted LLDP packet to an interface of an affected device and having an authenticated user retrieve LLDP statistics from the affected device through CLI show commands or Simple Network Management Protocol (SNMP) requests. A successful exploit could allow the attacker to cause the LLDP service to crash and stop running on the affected device. In certain situations, the LLDP crash may result in a reload of the affected device.

    Note: LLDP is a Layer 2 link protocol. To exploit this vulnerability, an attacker would need to be directly connected to an interface of an affected device, either physically or logically (for example, through a Layer 2 Tunnel configured to transport the LLDP protocol).

    Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

    This advisory is available at the following link:
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-lldp-dos-z7PncTgt

    This advisory is part of the February 2024 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: February 2024 Semiannual Cisco FXOS and NX-OS Software Security Advisory Bundled Publication.

Affected Products

  • Vulnerable Products

    At the time of publication, this vulnerability affected the following Cisco products if they were running a vulnerable release of Cisco FXOS or NX-OS Software and had the LLDP feature enabled globally and on at least one interface:

    For information about which Cisco software releases were vulnerable at the time of publication, see the Fixed Software section of this advisory. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.

    Determine the Status of LLDP for Cisco FXOS Software

    The LLDP feature is enabled by default on Cisco FXOS software and cannot be fully disabled. LLDP is always enabled on the management interface (mgmt0) and on internal backplane ports that connect to the blades. All other interfaces have LLDP disabled by default, with the option to enable it through a network control policy. Additional information is available in the Configure a Network Control Policy section of the Cisco Firepower 4100/9300 FXOS Firepower Chassis Manager Configuration Guide.

    To determine the status of LLDP on a specific interface, use the connect fxos command at the device CLI, then use the show lldp interface ethernet module/interface command. If the enable (rx) status is set to Y, the interface accepts incoming LLDP packets, as shown in the following example:

    FPR# show lldp interface ethernet 1/1
    Interface Information:
      Enable (tx/rx/dcbx): Y/Y/Y    Port Mac address: 00:fc:ba:05:04:94
     

    Determine the Status of LLDP on Cisco MDS and Nexus Switches That Are Running Cisco NX-OS Software

    The LLDP feature is disabled by default on Cisco MDS or Nexus Switches that are running Cisco NX-OS Software. To determine if the LLDP feature has been enabled, use the show feature | include lldp command at the device CLI. The following example shows that the LLDP feature is enabled:

    switch# show feature | include lldp
    lldp                   1          enabled

    If the LLDP feature has been enabled, LLDP is also enabled on all interfaces by default. Processing of incoming LLDP packets can be selectively disabled on a specific interface by using the no lldp receive interface-level configuration command.

    To determine the status of LLDP on a specific interface, use the show lldp interface ethernet module/interface command at the device CLI. If the enable (rx) status is set to Y, the interface accepts incoming LLDP packets, as shown in the following example:

    switch# show lldp interface ethernet 1/1
    Interface Information:
      Enable (tx/rx/dcbx): Y/Y/Y    Port Mac address: 00:a6:ca:b6:84:5a
     

    Determine the Status of LLDP on Cisco Nexus 9000 Series Fabric Switches in ACI Mode

    The LLDP feature is enabled by default on Cisco Nexus 9000 Series Fabric Switches in ACI mode and cannot be fully disabled. LLDP is enabled by default on all fabric ports and access ports.

    Processing of incoming LLDP packets can be selectively disabled on a specific access port by using the no lldp receive interface-level configuration command from the APIC NX-OS style CLI, or by having LLDP disabled in the applied access policy. Additional information is available in the Access Policies Overview section of the Cisco Application Centric Infrastructure Fundamentals Guide.

    To determine the status of LLDP on a specific interface, use the show lldp interface ethernet module/interface command at the device CLI. If the enable (rx) status is set to Y, the interface accepts incoming LLDP packets, as shown in the following example:

    switch# show lldp interface ethernet 1/1
    Interface Information:
      Enable (tx/rx/dcbx): Y/Y/N    Port Mac address: 50:87:89:a2:10:39
     

    Determine the Status of LLDP on Cisco UCS Fabric Interconnects

    The LLDP feature is enabled by default on Cisco UCS 6200, 6300, 6400, and 6500 Series Fabric Interconnects and cannot be fully disabled. LLDP is always enabled on the following interfaces:

    • Ethernet uplink ports (network interfaces that connect to upstream switches for network connectivity)
    • Ethernet port channel members
    • Fibre Channel over Ethernet (FCoE) uplink ports
    • Management interface (mgmt0)

    LLDP may also be enabled on server ports (interfaces that are presented to the servers in the Cisco UCS Manager domain) and appliance ports (interfaces that connect to directly attached NFS storage) through a network control policy. Additional information is available in the Configuring Network Control Policies section of the Cisco UCS Manager Network Management Guide.

    To determine the status of LLDP on a specific interface, use the connect nxos command at the device CLI, then use the show lldp interface ethernet module/interface command. If the enable (rx) status is set to Y, the interface accepts incoming LLDP packets, as shown in the following example:

    FI-A# show lldp interface ethernet 1/1/1
    Interface Information:
      Enable (tx/rx/dcbx): Y/Y/Y    Port Mac address: 00:c8:8b:84:a2:54
     

    Products Confirmed Not Vulnerable

    Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.

    Cisco has confirmed that this vulnerability does not affect the following Cisco products:

    • Firepower 1000 Series
    • Firepower 2100 Series
    • Nexus 1000 Virtual Edge for VMware vSphere
    • Nexus 1000V Switch for Microsoft Hyper-V
    • Nexus 1000V Switch for VMware vSphere
    • Secure Firewall 3100 Series
    • Secure Firewall 4200 Series

Details

  • Exploitation of this vulnerability may cause the LLDP service to crash repeatedly and to generate one or more core files on the affected device. The repeated crashes may result either in the LLDP service no longer running on the affected device or in an overall reload of the device.

    If the LLDP service stops running on the affected device, execution of any show lldp command at the device CLI will result in service not enabled output, as shown in the following example:

    switch# show lldp traffic
    Service not enabled

    In this situation, a reload of the affected device is required to restart the LLDP service.

Workarounds

  • There are no workarounds that address this vulnerability.

Fixed Software

  • When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.

    In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.

    Cisco FXOS and NX-OS Software

    To help customers determine their exposure to vulnerabilities in Cisco FXOS and NX-OS Software, Cisco provides the Cisco Software Checker. This tool identifies any Cisco security advisories that impact a specific software release and the earliest release that fixes the vulnerabilities that are described in each advisory (“First Fixed”). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities that are described in all the advisories that the Software Checker identifies (“Combined First Fixed”).

    To use the tool, go to the Cisco Software Checker page and follow the instructions. Alternatively, use the following form to search for vulnerabilities that affect a specific software release. To use the form, follow these steps:

    1. Choose which advisories the tool will search—only this advisory, only advisories with a Critical or High Security Impact Rating (SIR), or all advisories.
    2. Choose the appropriate software.
    3. Choose the appropriate platform.
    4. Enter a release number—for example, 2.9.1.158 for Cisco Firepower 4100 Series Security Appliances or 7.0(3)I7(5) for Cisco Nexus 3000 Series Switches.
    5. Click Check.
     

     

     

    Cisco UCS Software

    At the time of publication, the release information in the following table(s) was accurate. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.

    The left column lists Cisco software releases, and the right column indicates whether a release was affected by the vulnerability described in this advisory and which release included the fix for this vulnerability.

    UCS 6200, 6300, 6400, and 6500 Series Fabric Interconnects

    Cisco UCS Software Release First Fixed Release
    Earlier than 4.1 Migrate to a fixed release.
    4.1 4.1(3m)
    4.2 4.2(3j)
    4.3 4.3(2b)

    The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.

    Additional Resources

    For help determining the best Cisco NX-OS Software release for a Cisco Nexus Switch, see the following Recommended Releases documents. If a security advisory recommends a later release, Cisco recommends following the advisory guidance.

    Cisco MDS Series Switches
    Cisco Nexus 1000V for VMware Switch
    Cisco Nexus 3000 Series Switches
    Cisco Nexus 5500 Platform Switches
    Cisco Nexus 5600 Platform Switches
    Cisco Nexus 6000 Series Switches
    Cisco Nexus 7000 Series Switches
    Cisco Nexus 9000 Series Switches
    Cisco Nexus 9000 Series ACI-Mode Switches

    To determine the best release for Cisco UCS Software, see the Recommended Releases documents in the release notes for the device.

Exploitation and Public Announcements

  • The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Source

  • This vulnerability was found during the resolution of a Cisco TAC support case.

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Related to This Advisory

URL

Revision History

  • Version Description Section Status Date
    1.0 Initial public release. — Final 2024-FEB-28
    Show Less

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Related to This Advisory