PT-2025-3689 · Arista · Arista Eos

Published 2025-01-10 · Updated 2025-01-14 · CVE-2024-7095

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Arista EOS versions prior to 4.32.2F

Description On affected platforms running Arista EOS with SNMP configured, if snmp-server transmit max-size is configured, under some circumstances a specially crafted packet can cause the snmpd process to leak memory. This may result in the snmpd process being terminated, causing SNMP requests to time out until snmpd is restarted, and memory pressure for other processes on the switch. Increased memory pressure can cause processes other than snmpd to be at risk for unexpected termination as well.

Recommendations For Arista EOS versions prior to 4.32.2F, consider disabling the snmp-server transmit max-size configuration to prevent the memory leak until a patch is available. Restrict access to the SNMP service to minimize the risk of exploitation. As a temporary workaround, monitor the system's memory usage and restart the snmpd process if necessary to prevent unexpected terminations.

Fix

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2024-7095

Affected Products

Arista Eos

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-7095 · Security Note
• https://twitter.com/VulmonFeeds/status/1878071048333070677 · Twitter Post
• https://t.me/cvedetector/15003 · Telegram Post
• https://arista.com/en/support/advisories-notices/security-advisory/20650-security-advisory-0107 · Note
• https://twitter.com/CVEnew/status/1877818233887359360 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1878009595798417538 · Twitter Post