Cisco has released critical security updates to address a high-severity DoS (Denial of Service) vulnerability that affects its IOS XR software. This vulnerability tracked as CVE-2023-20049, has a CVSS score of 8.6 and can potentially affect several enterprise-grade routers, including the ASR 9000 Series Aggregation Services Routers, ASR 9902 Compact High-Performance Routers, and ASR 9903 Compact High-Performance Routers.
Vulnerability Details
The vulnerability is located in the bidirectional forwarding detection (BFD) hardware offload feature of Cisco IOS XR software. An unauthenticated, remote attacker can exploit this flaw by sending a crafted IPv4 BFD packet to a vulnerable device. This can cause a line card to reset, leading to a DoS attack that can result in a loss of traffic over that line card while the line card reloads.
The advisory published by the vendor states that this vulnerability is due to the incorrect handling of malformed BFD packets that are received online cards where the BFD hardware offload feature is enabled.
Affected Products
This flaw affects Cisco routers that are running a vulnerable release of Cisco IOS XR 64-bit Software and have BFD hardware offload enabled for any of the installed line cards. Specifically, it affects the following products:
- ASR 9000 Series Aggregation Services Routers with Lightspeed or Lightspeed-Plus-based line cards installed
- ASR 9902 Compact High-Performance Routers
- ASR 9903 Compact High-Performance Routers
The company has confirmed that the following products are not affected by this vulnerability:
- IOS Software
- IOS XE Software
- IOS XR Platforms not listed in the Vulnerable Products section of this advisory
Security Updates and Workarounds
To mitigate the risk of DoS attacks, Cisco recommends disabling the BFD hardware offload and creating Infrastructure Access Control lists. However, the company has addressed the issue with the release of IOS XR versions 7.5.3, 7.6.2, and 7.7.1. Cisco strongly advises all customers to install the latest security updates as soon as possible to avoid any potential attacks.
Dimitris is an Information Technology and Cybersecurity professional with more than 20 years of experience in designing, building and maintaining efficient and secure IT infrastructures.
Among others, he is a certified: CISSP, CISA, CISM, ITIL, COBIT and PRINCE2, but his wide set of knowledge and technical management capabilities go beyond these certifications. He likes acquiring new skills on penetration testing, cloud technologies, virtualization, network security, IoT and many more.
