CVE-2021-1446: Cisco IOS XE DNS ALG DoS Vulnerability

CVE-2021-1446 Overview

CVE-2021-1446 is a denial of service (DoS) vulnerability in the DNS application layer gateway (ALG) functionality used by Network Address Translation (NAT) in Cisco IOS XE Software. An unauthenticated, remote attacker can trigger a device reload by sending crafted DNS packets through an affected device performing NAT for DNS traffic. The flaw stems from a logic error during inspection of certain DNS packets and is exploitable only via IPv4. IPv6 traffic cannot trigger the condition. Cisco published the advisory on March 24, 2021, tracking it as cisco-sa-alg-dos-hbBS7SZE. The weakness is categorized under [CWE-754] (Improper Check for Unusual or Exceptional Conditions).

Critical Impact
A single stream of crafted DNS packets traversing a NAT-enabled Cisco IOS XE device can force a reload, causing network-wide service disruption for any traffic dependent on the affected router.

Affected Products

Cisco IOS XE Software 3.x branches (3.7.x through 3.18.x) with NAT and DNS ALG enabled
Cisco IOS XE Software 16.x releases (16.1.x through 16.12.x)
Cisco IOS XE Software 17.x releases (17.1.x through 17.3.1w)

Discovery Timeline

2021-03-24 - Cisco publishes security advisory cisco-sa-alg-dos-hbBS7SZE
2021-03-24 - CVE-2021-1446 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-1446

Vulnerability Analysis

The vulnerability resides in the DNS application layer gateway (ALG) component invoked by the NAT subsystem in Cisco IOS XE. NAT requires special handling for DNS payloads because embedded IP addresses inside DNS records must be translated alongside the outer packet headers. The DNS ALG parses DNS messages traversing the NAT path to perform this fixup. A logic error in this parser fails to correctly handle certain malformed or unexpected DNS message structures. When the malformed message reaches the affected code path, the device aborts processing and reloads, producing a denial of service. The defect maps to [CWE-754], an improper check for an exceptional condition the developer assumed could not occur.

Root Cause

The root cause is an unchecked or improperly checked exceptional condition encountered while the DNS ALG inspects DNS packets selected for NAT translation. The handler does not validate the unexpected state and continues execution, leading to an unrecoverable fault and a device reload rather than dropping the offending packet.

Attack Vector

Exploitation requires only that crafted IPv4 DNS packets transit an affected device that performs NAT on DNS traffic. The attacker does not need credentials, user interaction, or an established session. Because DNS traffic frequently traverses Internet edge routers, an attacker positioned anywhere along the IPv4 forwarding path can reach the vulnerable inspection logic. IPv6 forwarding paths are unaffected. Confidentiality and integrity are not impacted; the consequence is loss of availability when the device reloads.

No public proof-of-concept code is available, and no verified exploitation has been observed. Refer to the Cisco Security Advisory for vendor technical details.

Detection Methods for CVE-2021-1446

Indicators of Compromise

Unexpected device reloads on Cisco IOS XE routers with NAT and DNS ALG enabled, accompanied by crash files referencing the NAT or ALG subsystems
IPv4 DNS traffic patterns containing malformed message headers, truncated questions, or anomalous resource record structures arriving immediately before a reload event
Loss of routing adjacencies (OSPF, BGP, EIGRP) coinciding with crash and reboot timestamps on affected devices

Detection Strategies

Inventory all Cisco IOS XE devices and identify those running affected versions with ip nat configured and DNS ALG active on the NAT path
Parse device syslog and crashinfo files for %SYS-2-WATCHDOG events or process crashes correlated with NAT or DNS ALG components
Inspect NetFlow/IPFIX or packet captures for DNS messages over IPv4 traversing the NAT boundary with malformed structure or oversized fields

Monitoring Recommendations

Forward syslog and SNMP traps from edge routers to a centralized log platform and alert on unscheduled reload events
Baseline DNS traffic volumes and structure across NAT interfaces, alerting on sudden spikes of malformed DNS packets
Continuously verify running IOS XE versions against the fixed releases documented in the Cisco advisory

How to Mitigate CVE-2021-1446

Immediate Actions Required

Identify all Cisco IOS XE devices running affected versions with NAT and DNS ALG enabled on IPv4 paths
Schedule upgrades to a fixed Cisco IOS XE release as listed in the Cisco Security Advisory
Restrict who can send DNS traffic through the NAT boundary using infrastructure access control lists where business requirements allow

Patch Information

Cisco has released fixed software addressing CVE-2021-1446. Consult the Cisco Security Advisory cisco-sa-alg-dos-hbBS7SZE for the specific fixed releases that correspond to each affected IOS XE train. Cisco recommends upgrading to a fixed release as the primary remediation; no software workaround fully addresses the condition.

Workarounds

Disable the DNS ALG for NAT if it is not required by the deployment, using the no ip nat service alg udp dns and no ip nat service alg tcp dns configuration commands
Where IPv4 NAT translation of DNS is not needed, remove DNS from NAT inspection entirely and rely on IPv6 paths or non-NAT DNS forwarding
Apply control plane and infrastructure ACLs to limit DNS traffic sources permitted to traverse the NAT boundary

bash

# Configuration example: disable DNS ALG inspection for NAT
configure terminal
 no ip nat service alg udp dns
 no ip nat service alg tcp dns
end
write memory

# Verify ALG status
show ip nat translations
show running-config | include nat service alg