CVE-2024-20317: Cisco IOS XR DoS Vulnerability

CVE-2024-20317 Overview

CVE-2024-20317 is a denial-of-service vulnerability in Cisco IOS XR Software running on multiple Cisco Network Convergence System (NCS) platforms. The flaw stems from incorrect classification of certain Ethernet frames received on an interface. An unauthenticated attacker on an adjacent network can send crafted Ethernet frames to or through an affected device to cause critical priority packets to be dropped. Successful exploitation disrupts control plane protocol relationships, resulting in a denial-of-service condition. Cisco has released software updates to address this vulnerability, and no workarounds are available.

Critical Impact
An adjacent, unauthenticated attacker can force affected Cisco IOS XR devices to drop high-priority control plane traffic, breaking routing adjacencies and causing network-wide service disruption.

Affected Products

Cisco IOS XR Software versions 7.7.1, 7.7.2, and 7.7.21
Cisco IOS XR Software versions 7.8.1, 7.8.2, and 7.8.22
Cisco IOS XR Software versions 7.9.1, 7.9.2, 7.9.21, and 7.10.1 on Cisco Network Convergence System (NCS) platforms

Discovery Timeline

2024-09-11 - CVE-2024-20317 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20317

Vulnerability Analysis

The vulnerability is categorized under [CWE-684] Incorrect Provision of Specified Functionality. Cisco IOS XR Software on affected NCS platforms fails to correctly classify certain Ethernet frames on ingress. Frames that should receive standard queuing treatment are instead handled in a way that conflicts with the classification of high-priority control plane traffic.

As a result, critical priority packets such as routing protocol keepalives and control plane messages can be dropped when the malicious frames are present. The dropped traffic causes control plane protocol relationships, including routing adjacencies and neighbor sessions, to time out and fail. The attacker does not need credentials, user interaction, or elevated privileges. The scope is changed because the impact extends beyond the initial vulnerable component into the wider control plane and adjacent network peers.

Root Cause

The root cause is a Layer 2 frame classification defect in the Ethernet packet processing path of IOS XR on NCS platforms. Specific Ethernet frame types are misclassified into the wrong internal queue or policer, causing legitimate high-priority packets to be discarded during contention.

Attack Vector

Exploitation requires network adjacency to a vulnerable interface, meaning the attacker must be on the same broadcast domain or a directly connected link. The attacker sends crafted Ethernet frames either destined to the device or transiting through it. No authentication is required. Because control plane traffic depends on timely delivery, sustained frame injection can quickly tear down BGP, OSPF, IS-IS, and other neighbor relationships. See the Cisco Security Advisory for details on affected frame types and platform-specific behavior.

Detection Methods for CVE-2024-20317

Indicators of Compromise

Unexpected flapping of BGP, OSPF, IS-IS, or LDP neighbor relationships on NCS platforms.
Sudden increases in dropped packets on high-priority ingress queues without a corresponding traffic surge.
Reception of unusual or malformed Ethernet frame types on customer-facing or peering interfaces.

Detection Strategies

Monitor control plane protocol state changes and correlate them with interface counter anomalies on IOS XR devices.
Enable ingress packet capture and classification counters on suspect interfaces to identify misclassified frames.
Compare running IOS XR software versions against the fixed releases listed in the Cisco advisory to identify exposed devices.

Monitoring Recommendations

Ingest syslog and SNMP traps from IOS XR devices into a centralized SIEM to alert on repeated adjacency loss.
Track show controllers and show qos interface output for drops in high-priority classes.
Baseline normal control plane traffic volume so that anomalous drop patterns trigger investigation.

How to Mitigate CVE-2024-20317

Immediate Actions Required

Inventory all Cisco NCS platforms and identify devices running IOS XR versions listed as affected.
Prioritize patching devices exposed to untrusted Layer 2 segments, peering interfaces, and customer-facing ports.
Restrict which devices can send Ethernet frames on adjacent segments using port security and access control at Layer 2.

Patch Information

Cisco has released software updates that address CVE-2024-20317. Refer to the Cisco Security Advisory cisco-sa-l2services-2mvHdNuC for the fixed release matrix mapped to each affected IOS XR train. Cisco explicitly states there are no workarounds that address this vulnerability, making patching the required remediation.

Workarounds

No workarounds are available from Cisco; upgrading to a fixed IOS XR release is required.
As a defense-in-depth measure, limit access to adjacent Layer 2 segments to trusted devices only.
Where feasible, apply strict Layer 2 filtering and BPDU/frame-type controls on edge ports until patches are deployed.

bash

# Verify IOS XR version and compare against Cisco fixed release table
show version | include "Cisco IOS XR Software"

# Review high-priority queue drops on suspect interfaces
show qos interface <interface> input
show controllers <interface> stats