PT-2022-9902 · Arista · Arista Eos

Published 2022-04-26 · Updated 2023-06-30 · CVE-2021-28510

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Arista EOS (affected versions not specified)

Description The issue occurs when a Precision Time Protocol (PTP) packet with an invalid Type-Length-Value (TLV) is received, causing the PTP agent to restart. Repeated restarts of the service will make it unavailable. A remote attacker can exploit this to make the PTP service unavailable, resulting in the switch failing to provide PTP time synchronization services to downstream devices. This can lead to the degradation of time maintained by these devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-1284

Related Identifiers

CVE-2021-28510

Affected Products

Arista Eos

References · 3

• 🔥 https://arista.com/en/support/advisories-notices/security-advisory/15439-security-advisory-0076 · Exploit
• https://osv.dev/vulnerability/CVE-2021-28510 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28510 · Security Note