PT-2023-19658 · Arista · Arista Eos

Published 2023-04-11 · Updated 2023-04-21 · CVE-2023-24511

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Arista EOS (affected versions not specified)

Description The issue is caused by a specially crafted packet that can lead to a memory leak in the snmpd process on affected platforms running Arista EOS with SNMP configured. This may result in the snmpd processing being terminated, causing SNMP requests to time out until snmpd is automatically restarted, and potential memory resource exhaustion for other processes on the switch. The vulnerability does not have any confidentiality or integrity impacts to the system. It was reported externally by an Arista customer, and Arista is not aware of any malicious uses of this issue in customer networks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2023-24511

Affected Products

Arista Eos

References · 5

• 🔥 https://arista.com/en/support/advisories-notices/security-advisory/17239-security-advisory-0084 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-24511 · Security Note
• https://osv.dev/vulnerability/CVE-2023-24511 · Vendor Advisory
• https://t.me/cibsecurity/62024 · Telegram Post
• https://t.me/cvenotify/48802 · Telegram Post