Buffer overflow in Cisco Systems, Inc products - CVE-2024-20294

Vulnerability identifier: #VU86915

CSH Severity: Medium

CVSS v4: 6.8 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-20294

CWE-ID: CWE-119

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the Link Layer Discovery Protocol (LLDP) feature. A remote attacker on the local network can trigger memory corruption and cause a denial of service condition on the target system.

UCS 6500 Series Fabric Interconnects
Cisco Nexus 3000 Series Switches
Nexus 5500 Platform Switches
Nexus 5600 Platform Switches
Nexus 6000 Series Switches
Nexus 7000 Series Switches
Cisco Nexus 9000 Series Switches in ACI Mode
Cisco Nexus 9000 Series Switches NX-OS Mode
UCS 6400 Series Fabric Interconnects
Cisco MDS 9000 Series Multilayer Switches
UCS 6200 Series Fabric Interconnects
UCS 6300 Series Fabric Interconnects
Firepower 4100 Series Security Appliances
Cisco Firepower 9300 Security Appliance
Cisco FXOS
Cisco NX-OS
PowerFlex Appliance
PowerFlex rack

Install update from vendor's website.

UCS 6500 Series Fabric Interconnects - addressed in versions 4.1(3m), 4.2(3j), 4.3(2b)
UCS 6400 Series Fabric Interconnects - addressed in versions 4.1(3m), 4.2(3j), 4.3(2b)
UCS 6200 Series Fabric Interconnects - addressed in versions 4.1(3m), 4.2(3j), 4.3(2b)
UCS 6300 Series Fabric Interconnects - addressed in versions 4.1(3m), 4.2(3j), 4.3(2b)
Cisco FXOS - addressed in versions IMM-4.3(2.230117), 2.10.1.312, 2.11.1.228, 2.12.1.72, 2.13.0.276, 4.1(3m)UCSM, 4.2(3j)UCSM, 4.3(2b)UCSM, 7.3(14)N1(1), 8.2(11), 8.4(8), 8.4(9), 9.3(4)IUF9(0), 9.3(4)IUF9(0.557), 9.3(5)I43(2a), 9.3(5)I43(2a.22), 9.3(5)I43(2a.27), 9.3(5)I43(2a.28), 9.3(5)I43(2a.29), 9.3(12), 9.3(13), 9.4(1a), 9.4(1), 10.2(6), 10.2(7), 10.3(3), 10.3(4a), 10.3(99w), 10.3(99x), 10.4(1), 10.4(2), 15.2(8h), 15.3(2a), 16.0(4c)
Cisco NX-OS - addressed in versions IMM-4.3(2.230117), 2.10.1.312, 2.11.1.228, 2.12.1.72, 2.13.0.276, 4.1(3m)UCSM, 4.2(3j)UCSM, 4.3(2b)UCSM, 7.3(14)N1(1), 8.2(11), 8.4(8), 8.4(9), 9.3(4)IUF9(0), 9.3(4)IUF9(0.557), 9.3(5)I43(2a), 9.3(5)I43(2a.22), 9.3(5)I43(2a.27), 9.3(5)I43(2a.28), 9.3(5)I43(2a.29), 9.3(12), 9.3(13), 9.4(1a), 9.4(1), 10.2(6), 10.2(7), 10.3(3), 10.3(4a), 10.3(99w), 10.3(99x), 10.4(1), 10.4(2), 15.2(8h), 15.3(2a), 16.0(4c)
PowerFlex Appliance - update to IC 45.374.00
PowerFlex rack - addressed in versions 3.6.6.0, 3.7.4.0

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-lldp-dos-z7PncTgt
• https://www.dell.com/support/kbdoc/nl-nl/000224066/dsa-2024-154-security-update-for-dell-connectrix-nx-os-sw-and-mds-9000-switches-link-layer-discovery-protocol-lldp-vulnerabilities

• Denial of service in Cisco FXOS and NX-OS Software
• Multiple vulnerabilities in Dell PowerFlex Appliance
• Multiple vulnerabilities in Dell PowerFlex Rack
• Multiple vulnerabilities in Dell PowerFlex Rack