CVE-2024-20304

Опубликовано: 11 сент. 2024

Источник: nvd

CVSS3: 8.6

CVSS3: 7.5

EPSS Низкий

Описание

This vulnerability exists because the Mtrace2 code does not properly handle packet memory. An attacker could exploit this vulnerability by sending crafted packets to an affected device. A successful exploit could allow the attacker to exhaust the incoming UDP packet memory. The affected device would not be able to process higher-level UDP-based protocols packets, possibly causing a denial of service (DoS) condition. Note: This vulnerability can be exploited using IPv4 or IPv6.

Ссылки

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pak-mem-exhst-3ke9FeFy
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:cisco:ios_xr:7.7.1:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ios_xr:7.7.2:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ios_xr:7.7.21:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ios_xr:7.8.1:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ios_xr:7.8.2:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ios_xr:7.8.12:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ios_xr:7.8.22:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ios_xr:7.9.1:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ios_xr:7.9.2:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ios_xr:7.9.21:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ios_xr:7.10.1:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ios_xr:7.10.2:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ios_xr:7.11.1:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ios_xr:7.11.2:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ios_xr:24.1.1:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ios_xr:24.1.2:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ios_xr:24.2.1:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ios_xr:24.2.11:*:*:*:*:*:*:*

EPSS

Процентиль: 72%

0.00724

Низкий

8.6 High

CVSS3

7.5 High

CVSS3

Дефекты

CWE-401

Связанные уязвимости

GHSA-3252-jgxw-qhmv

CVSS3: 8.6

github

больше 1 года назад

A vulnerability in the multicast traceroute version 2 (Mtrace2) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust the UDP packet memory of an affected device. This vulnerability exists because the Mtrace2 code does not properly handle packet memory. An attacker could exploit this vulnerability by sending crafted packets to an affected device. A successful exploit could allow the attacker to exhaust the incoming UDP packet memory. The affected device would not be able to process higher-level UDP-based protocols packets, possibly causing a denial of service (DoS) condition. Note: This vulnerability can be exploited using IPv4 or IPv6.

BDU:2024-06877

CVSS3: 8.6

fstec

больше 1 года назад

Уязвимость функции многоадресной трассировки (Mtrace2) операционной системы Cisco IOS XR, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 72%

0.00724

Низкий

8.6 High

CVSS3

7.5 High

CVSS3

Дефекты

CWE-401