CVE-2024-20327: Cisco IOS XR PPPoE DoS Vulnerability

CVE-2024-20327 Overview

Cisco disclosed CVE-2024-20327, a denial of service (DoS) vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software running on Cisco ASR 9000 Series Aggregation Services Routers. An unauthenticated, adjacent attacker can crash the ppp_ma process by sending a malformed PPPoE packet to an affected line card interface. The flaw affects routers running Broadband Network Gateway (BNG) functionality with PPPoE termination on Lightspeed-based or Lightspeed-Plus-based line cards. Successful exploitation disrupts PPPoE traffic across the entire router.

Critical Impact
A single crafted PPPoE frame from the adjacent Layer 2 network can crash the ppp_ma process, causing a full denial of service for PPPoE subscriber traffic across the ASR 9000 router.

Affected Products

Cisco IOS XR Software on ASR 9000 Series Aggregation Services Routers
Cisco ASR 9001, 9006, 9010, 9901, 9902, 9903, 9904, 9906, 9910, 9912, 9922
Cisco ASR 9000v-v2 line cards (Lightspeed-based and Lightspeed-Plus-based)

Discovery Timeline

2024-03-13 - CVE-2024-20327 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20327

Vulnerability Analysis

The vulnerability is classified as an Improper Input Validation issue [CWE-20] affecting the PPPoE termination code path within Cisco IOS XR. On ASR 9000 routers configured for BNG, the ppp_ma (PPP Manager) process handles PPPoE session establishment and maintenance. When a Lightspeed-based or Lightspeed-Plus-based line card receives a malformed PPPoE frame, the ppp_ma process fails to validate the packet structure correctly and crashes.

Once the ppp_ma process terminates unexpectedly, all PPPoE subscriber traffic traversing the router is disrupted. Because the flaw resides in a packet parsing routine reachable from the data plane, no authentication or user interaction is required.

Root Cause

The root cause is improper handling of malformed PPPoE packets received on interfaces of Lightspeed-based or Lightspeed-Plus-based line cards. The parsing logic within the ppp_ma process does not adequately validate PPPoE header fields before processing them, permitting a crafted frame to trigger a fatal condition in the process.

Attack Vector

An attacker must be adjacent to the target on the same broadcast domain as an affected line card interface. The attacker sends a crafted PPPoE discovery or session-stage packet to any interface on the affected line card, even one that is not itself configured to terminate PPPoE. The router's line card forwards the frame to the ppp_ma process, which crashes upon parsing the malformed content. See the Cisco Security Advisory for the full technical write-up.

Detection Methods for CVE-2024-20327

Indicators of Compromise

Unexpected termination or restart of the ppp_ma process on ASR 9000 devices running BNG
Loss of PPPoE subscriber sessions across the router without a corresponding configuration change
Syslog entries referencing ppp_ma process crashes or core dumps generated on affected line cards

Detection Strategies

Monitor show processes ppp_ma output and process restart counters for anomalies
Parse Cisco IOS XR syslog for PROCESS-3-ABORT, SYSMGR-4-CRASH, or PPP subsystem error messages correlated with subscriber disconnects
Correlate mass PPPoE subscriber re-authentication events with Layer 2 frame captures on adjacent segments

Monitoring Recommendations

Enable SNMP traps or streaming telemetry for process health and crash events on ASR 9000 routers
Capture PPPoE Discovery (PPPoED) and Session (PPPoES) traffic on subscriber-facing interfaces to identify malformed frames
Baseline normal PPPoE control-plane activity and alert on sudden spikes of malformed or oversized PPPoE frames

How to Mitigate CVE-2024-20327

Immediate Actions Required

Inventory ASR 9000 devices to identify those running IOS XR with BNG PPPoE termination on Lightspeed or Lightspeed-Plus line cards
Apply the fixed Cisco IOS XR release documented in the Cisco Security Advisory to all affected devices
Restrict Layer 2 access to subscriber-facing interfaces so only authorized customer equipment can reach PPPoE-enabled line cards

Patch Information

Cisco has released fixed software addressing CVE-2024-20327. Refer to the Cisco Security Advisory cisco-sa-iosxr-pppma-JKWFgneW for the specific fixed IOS XR release trains applicable to each ASR 9000 platform. No workaround exists that fully eliminates the vulnerability; upgrading is the definitive remediation.

Workarounds

Enforce strict Layer 2 segmentation and port security on access-facing interfaces to limit which hosts can transmit PPPoE frames
Where operationally acceptable, migrate PPPoE termination away from Lightspeed and Lightspeed-Plus line cards to unaffected hardware
Deploy control-plane and subscriber-plane rate limiting to reduce the impact of malformed PPPoE traffic while patching is scheduled

bash

# Verify IOS XR version and BNG PPPoE configuration on ASR 9000
show version
show platform
show pppoe summary
show processes ppp_ma location all