CVE-2024-20318: Cisco IOS XR Software DoS Vulnerability

CVE-2024-20318 Overview

CVE-2024-20318 is a denial of service (DoS) vulnerability in the Layer 2 Ethernet services of Cisco IOS XR Software. An unauthenticated, adjacent attacker can send crafted Ethernet frames to trigger a reset of the line card network processor. Repeated resets escalate to a full line card reset, dropping traffic on all supported interfaces.

The flaw is tracked as an improper input validation issue [CWE-20]. It affects line cards that have the Layer 2 services feature enabled. Cisco disclosed the issue through its Product Security Incident Response Team advisory process.

Critical Impact
A single adjacent attacker can force line card resets on affected Cisco IOS XR devices, causing sustained traffic loss across service provider and enterprise backbones.

Affected Products

Cisco IOS XR Software with Layer 2 Ethernet services enabled
Cisco line cards processing Layer 2 VPN (L2VPN) traffic
Refer to the Cisco Security Advisory for the complete list of affected platforms and releases

Discovery Timeline

2024-03-13 - CVE-2024-20318 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20318

Vulnerability Analysis

The vulnerability resides in the Layer 2 Ethernet services handling path of Cisco IOS XR Software. The affected code fails to correctly process specific Ethernet frame structures on ingress interfaces where Layer 2 services are enabled. Malformed frames reaching the ingress network processor cause the processor to reset.

The attack requires only adjacent network access. No authentication or user interaction is needed. Impact is limited to availability, but the effect propagates from a single interface to an entire line card after repeated resets.

Because Cisco IOS XR platforms often serve as aggregation and provider-edge routers, a line card reset removes multiple customer or transit circuits from service simultaneously. The vulnerability does not expose data or permit code execution.

Root Cause

The root cause is improper input validation [CWE-20] in the Layer 2 Ethernet frame parser. The parser does not correctly handle certain frame structures before they reach the network processor pipeline. Cisco describes this as incorrect handling of specific Ethernet frames received on Layer 2-enabled line cards.

Attack Vector

Exploitation requires the attacker to be on the same Layer 2 broadcast domain as an affected interface. The attacker transmits crafted Ethernet frames toward the ingress interface. A single frame causes one network processor reset. Repeated transmission triggers the line card reset threshold and produces a sustained DoS condition.

No verified public proof-of-concept is available. See the Cisco Security Advisory for technical details on frame characteristics and vulnerable configurations.

Detection Methods for CVE-2024-20318

Indicators of Compromise

Unexpected network processor (NP) resets logged in show logging or platform trace outputs
Line card reload events on devices with L2VPN or Layer 2 Ethernet services enabled
Sudden loss of traffic across multiple interfaces sharing a single network processor
Syslog entries referencing NP crash or NP recovery on affected line cards

Detection Strategies

Monitor Cisco IOS XR syslog for network processor reset messages and correlate against ingress interface counters
Alert on repeated line card reload events within short windows, which indicate the DoS threshold has been reached
Baseline expected Layer 2 control and data plane frame types on provider-edge interfaces and flag anomalies

Monitoring Recommendations

Forward Cisco IOS XR syslog and SNMP traps to a centralized SIEM for correlation with interface flap events
Track NP recovery counters using telemetry streams and platform show commands on a scheduled interval
Review MAC-layer traffic on customer-facing L2VPN attachment circuits for malformed or unexpected frame types

How to Mitigate CVE-2024-20318

Immediate Actions Required

Identify Cisco IOS XR devices with Layer 2 Ethernet services or L2VPN features enabled
Apply the fixed Cisco IOS XR Software release identified in the vendor advisory
Restrict Layer 2 adjacency to trusted circuits and disable Layer 2 services on interfaces that do not require them
Enable storm control and MAC-layer access controls on customer-facing ports where feasible

Patch Information

Cisco has released fixed software versions addressing CVE-2024-20318. Consult the Cisco Security Advisory cisco-sa-xrl2vpn-jesrU3fc for the fixed release matrix and upgrade guidance specific to each affected platform.

Workarounds

Cisco has not published a configuration workaround that fully mitigates the issue; upgrade is the recommended path
Limit the Layer 2 broadcast domain reachability of affected interfaces to reduce adjacent attacker exposure
Where operationally acceptable, disable unused Layer 2 Ethernet services on line cards until patching is complete