CVE-2021-34703: Cisco IOS LLDP DoS Vulnerability

CVE-2021-34703 Overview

A vulnerability in the Link Layer Discovery Protocol (LLDP) message parser of Cisco IOS Software and Cisco IOS XE Software could allow an attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. This vulnerability is due to improper initialization of a buffer within the LLDP processing component.

An attacker could exploit this vulnerability through multiple attack vectors: an authenticated remote attacker could access the LLDP neighbor table via the CLI or SNMP while the device is in a specific state; an unauthenticated adjacent attacker could corrupt the LLDP neighbor table by injecting specific LLDP frames into the network; or an authenticated adjacent attacker with SNMP read-only credentials or low privileges could combine frame injection with table access to trigger the vulnerability.

Critical Impact

Successful exploitation causes the affected Cisco device to crash and reload, resulting in network service disruption across enterprise and data center environments running vulnerable Cisco IOS or IOS XE software.

Affected Products

• Cisco IOS Software
• Cisco IOS XE Software
• Cisco Integrated Services Routers (1000, 1100, 4000 series)
• Cisco Catalyst Switches (3650, 3850, 9200, 9300, 9400, 9500, 9600, 9800 series)
• Cisco CSR 1000v Cloud Services Router

Discovery Timeline

• September 23, 2021 - CVE-2021-34703 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-34703

Vulnerability Analysis

This vulnerability exists within the LLDP message parser component of Cisco IOS and IOS XE Software. LLDP is a Layer 2 protocol used by network devices to advertise their identity, capabilities, and neighbors on a local area network. The vulnerable code path is triggered when the LLDP neighbor table is accessed via CLI or SNMP while the device has processed malformed LLDP frames.

The vulnerability can be exploited through three distinct methods:

1. Authenticated Remote Attack: An attacker with CLI or SNMP access can trigger the vulnerability by querying the LLDP neighbor table when the device is in a vulnerable state.

2. Unauthenticated Adjacent Attack: An attacker on the same network segment can inject specially crafted LLDP frames to corrupt the neighbor table, then wait for an administrator or NMS to query the table.

3. Authenticated Adjacent Attack: An attacker with limited SNMP read-only credentials or low CLI privileges can inject malicious LLDP frames and then access the corrupted table themselves.

The attack requires network access and specific timing conditions, as the device must be in a particular state for exploitation to succeed.

Root Cause

The vulnerability stems from improper initialization of a buffer (CWE-665: Improper Initialization, CWE-456: Missing Initialization of a Variable). When LLDP frames are processed and stored in the neighbor table, certain buffer variables are not properly initialized before use. When the neighbor table is subsequently accessed, these uninitialized memory regions can cause the device to crash due to unexpected values or memory access violations.

Attack Vector

The attack can be executed over the network with low privileges required. For the adjacent attacker scenarios, the attacker must be able to send Layer 2 LLDP frames on the same network segment as the target device. The attack does not require any user interaction beyond administrative access to the LLDP neighbor table, which can occur during routine network management operations.

The exploitation flow typically involves:

1. Attacker injects crafted LLDP frames containing specific malformed data into the network
2. The target device receives and processes these frames, storing entries in the LLDP neighbor table
3. Due to improper buffer initialization, corrupted data is stored in memory
4. When an administrator or NMS queries the LLDP neighbor table via show lldp neighbors CLI command or SNMP OID access, the device attempts to read the uninitialized buffer
5. The memory access violation triggers a device crash and automatic reload

Detection Methods for CVE-2021-34703

Indicators of Compromise

• Unexpected device reloads or crashes on Cisco IOS/IOS XE devices with LLDP enabled
• Crash logs indicating memory access violations in LLDP-related processes
• Unusual LLDP traffic patterns or malformed LLDP frames captured on network segments
• Multiple devices experiencing simultaneous reloads after LLDP neighbor table queries

Detection Strategies

• Monitor syslog for crash events related to LLDP processing or memory exceptions
• Implement network traffic analysis to detect anomalous LLDP frame patterns or high LLDP frame rates
• Configure SNMP traps for device reload events and correlate with LLDP neighbor table access patterns
• Deploy network intrusion detection rules to identify malformed LLDP frames with unusual TLV structures

Monitoring Recommendations

• Enable crash dump collection on all affected Cisco devices to facilitate post-incident analysis
• Implement centralized logging to correlate device reload events across the network infrastructure
• Monitor SNMP and CLI access patterns to LLDP neighbor tables across managed devices
• Establish baseline LLDP traffic patterns to identify anomalous injection attempts

How to Mitigate CVE-2021-34703

Immediate Actions Required

• Review the Cisco Security Advisory to determine if your software version is affected
• Apply the vendor-provided software updates to all affected Cisco IOS and IOS XE devices
• Consider disabling LLDP on interfaces where it is not operationally required
• Restrict network access to prevent untrusted devices from sending LLDP frames on critical network segments

Patch Information

Cisco has released security updates to address this vulnerability. Organizations should consult the Cisco Security Advisory for specific fixed software versions applicable to their deployed platforms. The advisory provides detailed information on affected and fixed releases for both Cisco IOS and Cisco IOS XE Software.

Workarounds

• Disable LLDP globally or on specific interfaces where the protocol is not required using no lldp run or no lldp transmit and no lldp receive interface commands
• Implement Layer 2 access control to restrict which devices can send LLDP frames on the network
• Use port security features to limit the number of MAC addresses on switch ports and prevent unauthorized LLDP frame injection
• Segment the network to isolate critical infrastructure from potentially compromised network segments

# Configuration example - Disable LLDP globally
configure terminal
no lldp run
end
write memory

# Configuration example - Disable LLDP on specific interface
configure terminal
interface GigabitEthernet0/0
 no lldp transmit
 no lldp receive
end
write memory