CVE-2024-20312: Cisco IOS IS-IS Protocol DoS Vulnerability

CVE-2024-20312 Overview

A vulnerability exists in the Intermediate System-to-Intermediate System (IS-IS) protocol implementation of Cisco IOS Software and Cisco IOS XE Software that could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on affected network devices. This vulnerability stems from insufficient input validation when parsing ingress IS-IS packets, enabling attackers with Layer 2 adjacency to trigger device reloads through specially crafted packets.

Critical Impact

An adjacent attacker who has formed an IS-IS adjacency can send crafted packets to cause affected Cisco network devices to reload, resulting in network outages and service disruption.

Affected Products

• Cisco IOS Software (versions 15.0 through 15.9)
• Cisco IOS XE Software (versions 3.2 through 17.11)
• Cisco routers and switches running IS-IS routing protocol

Discovery Timeline

• March 27, 2024 - CVE-2024-20312 published to NVD
• August 26, 2025 - Last updated in NVD database

Technical Details for CVE-2024-20312

Vulnerability Analysis

This vulnerability affects the IS-IS routing protocol implementation in Cisco IOS and IOS XE software. IS-IS is a link-state routing protocol commonly used in large enterprise and service provider networks. The flaw exists in how the affected software processes incoming IS-IS protocol packets after an adjacency has been established between routing peers.

When an attacker who has Layer 2 connectivity to an affected device sends a specially crafted IS-IS packet, the device fails to properly validate the packet contents. This improper input validation triggers a null pointer dereference (CWE-476), causing the device to reload unexpectedly. The attack requires the attacker to first establish an IS-IS adjacency with the target device, meaning they must be on the same network segment and be able to participate in IS-IS neighbor formation.

The vulnerability's scope extends beyond the vulnerable component, meaning a successful exploit can impact resources managed by a different security authority. While the attack does not compromise confidentiality or integrity, it has a high impact on availability as it causes complete device reload.

Root Cause

The root cause of this vulnerability is a null pointer dereference (CWE-476) resulting from insufficient input validation in the IS-IS packet parsing code. When the affected software receives a malformed IS-IS packet with unexpected or missing fields after adjacency formation, it attempts to access a null pointer, causing an unhandled exception that forces the device to reload.

Attack Vector

The attack vector requires the attacker to be adjacent to the affected device at Layer 2 (the data link layer). This means the attacker must be on the same network segment or VLAN as the target device. The attack sequence involves:

1. The attacker positions themselves on a network segment where IS-IS is enabled
2. The attacker's system establishes an IS-IS adjacency with the target Cisco device
3. Once the adjacency is formed, the attacker sends a specially crafted IS-IS packet
4. The malformed packet triggers improper input validation in the IS-IS parsing code
5. The null pointer dereference causes the device to reload, disrupting network services

The vulnerability does not require authentication (the attacker does not need credentials) but does require adjacency formation, which provides some limitation on exploitability. No user interaction is required for exploitation.

Detection Methods for CVE-2024-20312

Indicators of Compromise

• Unexpected device reloads on Cisco routers or switches running IS-IS
• Crash dump files showing null pointer dereference in IS-IS processing functions
• Unusual IS-IS adjacency formation attempts from unexpected or rogue devices
• Repeated device restarts correlating with IS-IS protocol activity in logs

Detection Strategies

• Monitor system logs for unexpected reload events with crash reasons related to IS-IS protocol processing
• Implement syslog monitoring to detect patterns of device crashes across IS-IS-enabled devices
• Deploy SNMP traps to alert on device restart events and correlate with network topology changes
• Use network behavior analysis to identify anomalous IS-IS traffic patterns or unexpected adjacency formations

Monitoring Recommendations

• Enable logging of IS-IS adjacency state changes using log-adjacency-changes under the IS-IS router configuration
• Configure crash dump collection to preserve diagnostic information for post-incident analysis
• Implement centralized log aggregation to correlate restart events across multiple IS-IS devices
• Monitor for new or unexpected IS-IS neighbors joining the routing domain

How to Mitigate CVE-2024-20312

Immediate Actions Required

• Review the Cisco Security Advisory to determine if your software version is affected
• Plan and schedule upgrades to patched software versions as recommended by Cisco
• Audit network access controls to limit which devices can form IS-IS adjacencies
• Implement strict physical and logical access controls on network segments running IS-IS

Patch Information

Cisco has released software updates that address this vulnerability. Customers should consult the Cisco Security Advisory for specific fixed software versions and upgrade guidance. The advisory provides detailed information about which software releases contain the fix and the recommended upgrade paths for different product configurations.

Workarounds

• Implement IS-IS authentication to prevent unauthorized devices from forming adjacencies with affected routers
• Use access control lists (ACLs) to restrict which hosts can communicate with the router's IS-IS protocol
• Segment networks to limit Layer 2 adjacency to trusted devices only
• Consider temporarily disabling IS-IS on non-critical interfaces until patches can be applied

# Configuration example - Enable IS-IS authentication
router isis
 authentication mode md5 level-1
 authentication mode md5 level-2
 authentication key-chain ISIS-KEY level-1
 authentication key-chain ISIS-KEY level-2
!
key chain ISIS-KEY
 key 1
  key-string YOUR-SECRET-KEY