{
  "document": {
    "acknowledgments": [
      {
        "summary": "These vulnerabilities were found during the resolution of a Cisco TAC support case."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually crash. The memory consumption may negatively impact other processes that are running on the device.\r\n\r\nThese vulnerabilities are due to the incorrect handling of IGMP packets. An attacker could exploit these vulnerabilities by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to immediately crash the IGMP process or cause memory exhaustion, resulting in other processes becoming unstable. These processes may include, but are not limited to, interior and exterior routing protocols.\r\n\r\nCisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. There are multiple mitigations available to customers depending on their needs.\r\n\r\n",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "These vulnerabilities affect any Cisco device that is running any release of Cisco IOS XR Software if an active interface is configured under multicast routing and it is receiving DVMRP traffic.\r\n  Determine Whether Multicast Routing Is Enabled\r\nAn administrator can determine whether multicast routing is enabled on a device by issuing the show igmp interface command. The following output shows a device with multicast routing enabled:\r\n\r\n\r\nRP/0/0/CPU0:router# show igmp interface\r\n\r\nLoopback0 is up, line protocol is up\r\n  Internet address is 10.144.144.144/32\r\n  IGMP is enabled on interface\r\n  Current IGMP version is 3\r\n  IGMP query interval is 60 seconds\r\n  IGMP querier timeout is 125 seconds\r\n  IGMP max query response time is 10 seconds\r\n  Last member query response interval is 1 seconds\r\n  IGMP activity: 3 joins, 0 leaves\r\n  IGMP querying router is 10.144.144.144 (this system)\r\nTenGigE0/4/0/0 is up, line protocol is up\r\n  Internet address is 10.114.8.44/24\r\n  IGMP is enabled on interface\r\n  Current IGMP version is 3\r\n  IGMP query interval is 60 seconds\r\n  IGMP querier timeout is 125 seconds\r\n  IGMP max query response time is 10 seconds\r\n  Last member query response interval is 1 seconds\r\n  IGMP activity: 9 joins, 4 leaves\r\n  IGMP querying router is 10.114.8.11\r\n\r\nIf the output of show igmp interface is empty, multicast routing is not enabled and the device is not affected by these vulnerabilities.\r\n  Determine Whether the Device Is Receiving DVMRP Traffic\r\nAn administrator can determine whether the device is receiving DVMRP traffic by issuing the show igmp traffic command. The following output shows a device that is receiving DVMRP traffic:\r\n\r\n\r\nRP/0/0/CPU0:router#show igmp traffic\r\nFri Feb 13 12:00:00.000 UTC\r\n\r\nIGMP Traffic Counters\r\nElapsed time since counters cleared: 01:09:27\r\n\r\n                                   Received       Sent\r\nValid IGMP Packets                   380220        301\r\nQueries                                   0        143\r\nReports                                   0        158\r\nLeaves                                    0          0\r\nMtrace packets                            0          0\r\nDVMRP packets                        380220          0\r\n\r\nIf the DVMRP packets entry contains values of zero in the first column, and the counters remain zero on subsequent execution of the command, the device is not receiving DVMRP traffic.",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by these vulnerabilities.",
        "title": "Products Confirmed Not Vulnerable"
      },
      {
        "category": "general",
        "text": "These vulnerabilities result in memory exhaustion, which can impact other processes on the device. It is possible to recover the memory consumed by the IGMP process by restarting the IGMP process with the process restart igmp command as follows:\r\n\r\n\r\nRP/0/0/CPU0:router# process restart igmp\r\n\r\nIn the case of an immediate IGMP process crash, it is not necessary to manually restart the IGMP process because the system has already performed that action. This automated restart will recover the consumed memory.\r\n\r\nWhen considering mitigations, it should be understood that for the memory exhaustion case, the rate limiter and the access control methods are effective. For the immediate IGMP process crash case, only the access control method is effective.",
        "title": "Details"
      },
      {
        "category": "general",
        "text": "When a device is experiencing memory exhaustion based on exploitation of these vulnerabilities, the following messages may be seen in the system logs:\r\n\r\n\r\nRP/0/RSP1/CPU0:Aug 28 03:46:10.375 UTC: raw_ip[399]: %PKT_INFRA-PQMON-6-QUEUE_DROP : Taildrop on XIPC queue 1 owned by igmp (jid=1175)\r\nRP/0/RSP0/CPU0:Aug 28 03:46:10.380 UTC: raw_ip[399]: %PKT_INFRA-PQMON-6-QUEUE_DROP : Taildrop on XIPC queue 1 owned by igmp (jid=1175)\r\nRP/0/RSP0/CPU0:Aug 28 03:49:22.850 UTC: dumper[61]: %OS-DUMPER-7-DUMP_REQUEST : Dump request for process pkg/bin/igmp\r\nRP/0/RSP0/CPU0:Aug 28 03:49:22.851 UTC: dumper[61]: %OS-DUMPER-7-DUMP_ATTRIBUTE : Dump request with attribute 7 for process pkg/bin/igmp\r\nRP/0/RSP0/CPU0:Aug 28 03:49:22.851 UTC: dumper[61]: %OS-DUMPER-4-SIGSEGV : Thread 9 received SIGSEGV - Segmentation Fault\r\n\r\nWhen a device has experienced a crash of the IGMP process, the following messages may be seen in the system logs:\r\n\r\n\r\nRP/0/RSP0/CPU0:Aug 30 17:21:47.653 UTC: igmp[1169]: %HA-HA_WD_LIB-4-RLIMIT : wd_handle_sigxfsz: Reached 90% of RLIMIT_DATA\r\nRP/0/RSP0/CPU0:Aug 30 17:21:47.653 UTC: igmp[1169]: %ROUTING-IPV4_IGMP-4-OOM_STATE_THROTTLE : Received Critical memory depletion warning, stop creating new igmp state\r\nRP/0/RSP1/CPU0:Aug 30 17:23:50.442 UTC: sysmgr[94]: igmp(1) (jid 1169) (pid 121667828) (fail_count 2) abnormally terminated, restart scheduled",
        "title": "Indicators of Compromise"
      },
      {
        "category": "general",
        "text": "Although there are no workarounds for these vulnerabilities, there are multiple mitigations available to customers depending on their needs.\r\n\r\nAs a mitigation for the memory exhaustion case, it is recommended that customers implement a rate limiter. This will require that customers understand their current rate of IGMP traffic and set a rate lower than the current average rate. It is worth noting that there is a default limiter in place. In configuration mode, the customer can enter the lpts pifib hardware police flow igmp rate command as follows:\r\n\r\n\r\nRP/0/0/CPU0:router(config)# lpts pifib hardware police flow igmp rate \u003cvalue\u003e\r\n\r\nThis command will not remove the exploit vector. However, the command will reduce the traffic rate and increase the time necessary for successful exploitation. The customer can use this time to perform recovery actions.\r\n\r\nAs a mitigation for both the memory exhaustion case and the immediate IGMP process crash case, customers may implement an access control entry (ACE) to an existing interface access control list (ACL). Alternatively, the customer can create a new ACL for a specific interface that denies DVMRP traffic inbound on that interface. The following example creates an ACL and denies DVMRP traffic:\r\n\r\n\r\nRP/0/0/CPU0:router(config)# ipv4 access-list \u003cacl_name\u003e deny igmp any any dvmrp",
        "title": "Workarounds"
      },
      {
        "category": "general",
        "text": "Cisco has released free software updates that address the vulnerabilities described in this advisory. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:\r\nhttps://www.cisco.com/c/en/us/products/end-user-license-agreement.html [\"https://www.cisco.com/c/en/us/products/end-user-license-agreement.html\"]\r\n\r\nAdditionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.\r\n\r\nWhen considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page [\"https://www.cisco.com/go/psirt\"], to determine exposure and a complete upgrade solution.\r\n\r\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.\r\n  Customers Without Service Contracts\r\nCustomers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"]\r\n\r\nCustomers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.\r\n      Fixed Releases\r\nCisco has released Software Maintenance Upgrades (SMUs) to address these vulnerabilities. The following table describes which fixes are needed based on the Cisco IOS XR Software release:\r\n        Cisco IOS XR Software Release  Fix Needed for CSCvv54838  Fix Needed for CSCvr86414  Notes          Earlier than 6.6.3  Yes  Yes  Fixes are provided through bug CSCvv60110, which was created to combine the fixes for both CSCvv54838 and CSCvr86414.\r\n\r\nSMU names include CSCvv60110.      6.6.3 and later  Yes  No  Fix needed for only CSCvv54838. Releases 6.6.3 and later already contain the fix for CSCvr86414.\r\n\r\nSMU names include CSCvv54838.\r\nThe following tables provide the SMU name for each release based on platform.\r\n\r\nASR9K-PX\r\n        Cisco IOS XR Software Release  SMU Name          6.1.4  asr9k-px-6.1.4.CSCvv60110.pie      6.2.3  asr9k-px-6.2.3.CSCvv60110.pie      6.3.3  asr9k-px-6.3.3.CSCvv60110.pie      6.4.2  asr9k-px-6.4.2.CSCvv60110.pie      6.5.3  asr9k-px-6.5.3.CSCvv60110.pie      6.6.2  asr9k-px-6.6.2.CSCvv60110.pie      6.6.3  asr9k-px-6.6.3.CSCvv54838.pie\r\nASR9K-X64\r\n        Cisco IOS XR Software Release  SMU Name          6.1.4  asr9k-x64-6.1.4.CSCvv60110      6.2.3  asr9k-x64-6.2.3.CSCvv60110      6.4.2  asr9k-x64-6.4.2.CSCvv60110      6.6.2  asr9k-x64-6.6.2.CSCvv60110      6.6.3  asr9k-x64-6.6.3.CSCvv54838      7.0.2  asr9k-x64-7.0.2.CSCvv54838      7.1.15  asr9k-x64-7.1.15.CSCvv54838      7.1.2  asr9k-x64-7.1.2.CSCvv54838\r\nCRS\r\n        Cisco IOS XR Software Release  SMU Name          6.1.4  hfr-px-6.1.4.CSCvv60110.pie      6.4.2  hfr-px-6.4.2.CSCvv60110.pie      6.4.3  hfr-px-6.4.3.CSCvv60110.pie\r\nNCS5500\r\n        Cisco IOS XR Software Release  SMU Name          6.5.2  ncs5500-6.5.2.CSCvv60110",
        "title": "Fixed Software"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "general",
        "text": "On August 28, 2020, the Cisco Product Security Incident Response Team (PSIRT) became aware of attempted exploitation of these vulnerabilities in the wild. For affected products, Cisco recommends implementing a mitigation that is appropriate for the customer\u2019s environment.",
        "title": "Exploitation and Public Announcements"
      },
      {
        "category": "general",
        "text": "These vulnerabilities were found during the resolution of a Cisco TAC support case.",
        "title": "Source"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@cisco.com",
      "issuing_authority": "Cisco PSIRT",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "https://www.cisco.com/c/en/us/products/end-user-license-agreement.html",
        "url": "https://www.cisco.com/c/en/us/products/end-user-license-agreement.html"
      },
      {
        "category": "external",
        "summary": "considering software upgrades",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
      },
      {
        "category": "external",
        "summary": "Cisco\u0026nbsp;Security Advisories page",
        "url": "https://www.cisco.com/go/psirt"
      },
      {
        "category": "external",
        "summary": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html",
        "url": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"
      }
    ],
    "title": "Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities",
    "tracking": {
      "current_release_date": "2020-09-28T21:36:50+00:00",
      "generator": {
        "date": "2024-05-10T22:51:47+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz",
      "initial_release_date": "2020-08-29T03:00:00+00:00",
      "revision_history": [
        {
          "date": "2020-08-29T03:04:18+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        },
        {
          "date": "2020-08-31T21:32:08+00:00",
          "number": "2.0.0",
          "summary": "Added another Cisco bug ID and CVE ID. Updated wording throughout to reflect multiple vulnerabilities. Corrected a typo in the Determine Whether the Device Is Receiving DVMRP Traffic instructions. Removed an ineffective mitigation."
        },
        {
          "date": "2020-09-01T20:02:29+00:00",
          "number": "2.1.0",
          "summary": "Clarified the potential of the IGMP process crashing. Added DVMRP traffic requirement. Updated the mitigations according to specific exploit outcome."
        },
        {
          "date": "2020-09-28T21:36:50+00:00",
          "number": "2.2.0",
          "summary": "Added fixed software details."
        }
      ],
      "status": "final",
      "version": "2.2.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "Cisco IOS XR Software",
            "product": {
              "name": "Cisco IOS XR Software ",
              "product_id": "CSAFPID-5834"
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-3566",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvv54838"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-5834"
        ]
      },
      "release_date": "2020-08-29T03:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-5834"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-5834"
          ]
        }
      ],
      "title": "Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability"
    },
    {
      "cve": "CVE-2020-3569",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvr86414"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-5834"
        ]
      },
      "release_date": "2020-08-29T03:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-5834"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-5834"
          ]
        }
      ],
      "title": "Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability"
    }
  ]
}