CVE-2024-20464: Cisco IOS XE PIM DoS Vulnerability

CVE-2024-20464 Overview

CVE-2024-20464 is a high-severity denial of service vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco IOS XE Software. The flaw stems from insufficient validation of received IPv4 PIMv2 packets. An unauthenticated, remote attacker can exploit the issue by sending a crafted PIMv2 packet to a PIM-enabled interface on an affected device. Successful exploitation forces the device to reload, producing a denial of service condition. The vulnerability can be triggered using either an IPv4 multicast or unicast packet, broadening the conditions under which it can be reached.

Critical Impact
A single crafted PIMv2 packet can reload an affected Cisco IOS XE device, disrupting routing and network availability without authentication or user interaction.

Affected Products

Cisco IOS XE Software version 17.13.1
Cisco IOS XE Software version 17.13.1a
Devices with PIM enabled on at least one interface

Discovery Timeline

2024-09-25 - CVE-2024-20464 published to NVD
2024-10-24 - Last updated in NVD database

Technical Details for CVE-2024-20464

Vulnerability Analysis

The vulnerability resides in the PIMv2 packet processing path of Cisco IOS XE Software. PIM is a multicast routing protocol used to build distribution trees across IP networks. When a PIM-enabled interface receives a malformed PIMv2 packet, the input validation logic fails to reject the input safely. This drives the device into an unrecoverable state, triggering a reload. Because the issue is reachable via unicast or multicast traffic, an attacker does not need to be on the same multicast segment as the target. The scope is classified as changed, indicating the impact extends beyond the vulnerable component to the broader device and any traffic it forwards. The weakness is categorized under [CWE-20] Improper Input Validation.

Root Cause

The root cause is insufficient validation of fields within incoming IPv4 PIMv2 packets. The parser accepts crafted input that violates protocol expectations, leading to a condition that forces the device to reload. The packet handler does not adequately constrain field values or structure before processing.

Attack Vector

Exploitation requires network access to a PIM-enabled interface on the target router or switch running an affected Cisco IOS XE release. The attacker sends a single crafted IPv4 PIMv2 packet either as multicast directed at a PIM group or as unicast addressed to an interface IP. No authentication, credentials, or user interaction are required. Successful exploitation reloads the device and disrupts forwarding for all transiting traffic.

No public proof-of-concept code or verified exploit examples are available. Refer to the Cisco Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2024-20464

Indicators of Compromise

Unexpected device reloads with crash logs referencing the PIM process or PIMv2 packet handling
Inbound IPv4 PIMv2 packets (IP protocol 103) from unexpected sources, especially via unicast to router interfaces
Routing protocol instability and multicast tree reconvergence events coinciding with device restarts

Detection Strategies

Inspect device crash files and show logging output for PIM-related tracebacks following unscheduled reloads
Use NetFlow or packet capture on edge interfaces to identify PIMv2 traffic arriving from outside trusted multicast domains
Correlate SNMP coldStart or warmStart traps from Cisco IOS XE devices with upstream PIMv2 traffic patterns

Monitoring Recommendations

Alert on repeated device reloads across the routed infrastructure within short time windows
Monitor for IP protocol 103 (PIM) traffic destined to router interface IPs rather than the PIM all-routers multicast group 224.0.0.13
Forward syslog and crashinfo files from Cisco IOS XE devices to a centralized log platform for retention and correlation

How to Mitigate CVE-2024-20464

Immediate Actions Required

Inventory all devices running Cisco IOS XE 17.13.1 and 17.13.1a and identify those with PIM enabled
Apply the fixed Cisco IOS XE release identified in the vendor advisory
Restrict PIMv2 traffic at network boundaries to trusted multicast peers only
Disable PIM on interfaces where multicast routing is not required

Patch Information

Cisco has published fixed software in the Cisco Security Advisory cisco-sa-pim-APbVfySJ. Administrators should consult the advisory for the specific fixed releases corresponding to their deployed train and upgrade affected devices accordingly.

Workarounds

Apply infrastructure access control lists (iACLs) to block unsolicited IPv4 PIMv2 (IP protocol 103) packets destined to router interface addresses
Use control-plane policing (CoPP) to rate-limit PIM traffic delivered to the route processor
Where multicast is not in use, remove ip pim configuration from interfaces and disable ip multicast-routing globally

bash

# Example iACL fragment to deny unicast PIM to infrastructure addresses
! Permit PIM only from trusted neighbors
access-list 150 permit pim host <trusted_pim_neighbor> any
! Deny other PIM traffic to infrastructure address space
access-list 150 deny   pim any <infra_subnet> <wildcard>
access-list 150 permit ip any any
!
interface GigabitEthernet0/0/0
  ip access-group 150 in