CVE-2024-6437: Arista EOS Traffic Redirect DOS Vulnerability

CVE-2024-6437 Overview

CVE-2024-6437 affects Arista Networks EOS platforms configured with traffic redirection features. The flaw impacts policy-based routing (PBR), BGP Flowspec, and interface traffic policy configurations that use a set nexthop action. Certain IPv4 packets containing IP options bypass the configured nexthop redirection. These packets are trapped to the CPU and slow-path forwarded by the kernel through the Forwarding Information Base (FIB) instead of following the intended redirect destination. Attackers on the network can leverage this behavior to evade traffic steering policies and generate CPU load on affected devices.

Critical Impact
Traffic redirection policies can be bypassed by crafted IPv4 packets with IP options, undermining security controls and traffic engineering while placing additional load on the switch CPU.

Affected Products

Arista EOS with policy-based routing (PBR) configured for nexthop redirection
Arista EOS with BGP Flowspec configured for nexthop redirection
Arista EOS with interface traffic policy configured for nexthop redirection

Discovery Timeline

2025-01-10 - CVE-2024-6437 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6437

Vulnerability Analysis

The vulnerability affects the fast-path forwarding logic in Arista EOS when nexthop-based redirection is configured. Features such as PBR, BGP Flowspec, and interface traffic policy install ASIC-level rules that rewrite the next hop for matching flows. When an IPv4 packet contains IP options, the ASIC does not apply the redirect action. Instead, the packet is punted to the CPU and processed by the kernel's routing stack.

The kernel then forwards the packet according to the standard FIB lookup, ignoring the policy-defined nexthop. This results in a policy bypass with two operational consequences. First, traffic that operators intended to steer through a specific inspection or scrubbing path travels along the default route. Second, sustained delivery of such packets consumes control-plane CPU cycles.

Root Cause

The root cause is incomplete handling of IPv4 packets with IP options in the hardware fast path for redirect features. Packets requiring exception processing are trapped to the CPU, and the slow-path forwarding logic does not honor the configured set nexthop action. The behavior stems from a design gap between the ASIC redirect implementation and kernel-based exception forwarding [CWE-670: Always-Incorrect Control Flow Implementation].

Attack Vector

An attacker with network reachability to a link protected by PBR, BGP Flowspec, or interface traffic policy can send IPv4 packets that include IP options such as Record Route, Timestamp, or Loose Source Route. These packets bypass the redirect and follow standard FIB routing. No authentication or user interaction is required. The attack scope changes because policies enforcing security zoning or scrubber redirection are silently bypassed.

See the Arista Security Advisory #0108 for technical details and affected release trains.

Detection Methods for CVE-2024-6437

Indicators of Compromise

Unexpected IPv4 flows containing IP options arriving on interfaces protected by PBR, BGP Flowspec, or interface traffic policy
Traffic reaching destinations that should have been redirected by a set nexthop action
Increased control-plane CPU utilization correlated with IP-options traffic patterns

Detection Strategies

Compare flow telemetry (sFlow, IPFIX) against configured redirect policies to identify packets bypassing the intended nexthop
Enable counters on PBR, BGP Flowspec, and traffic policy rules and alert on divergence between rule hits and downstream traffic volume
Inspect packet captures for IPv4 headers with the Options field set on interfaces where redirection is expected

Monitoring Recommendations

Monitor Arista EOS CPU and punt-path counters for sustained increases tied to IP options traffic
Correlate SIEM logs of routing events with flow records to detect policy bypass patterns
Track BGP Flowspec rule installation state and hit counts on affected platforms

How to Mitigate CVE-2024-6437

Immediate Actions Required

Review Arista Security Advisory #0108 to identify which EOS release trains and hardware platforms in your environment are affected
Upgrade affected switches to a fixed EOS release listed in the vendor advisory
Audit PBR, BGP Flowspec, and interface traffic policy configurations that rely on set nexthop for security enforcement

Patch Information

Arista has published fixed software versions and remediation guidance in Arista Security Advisory #0108. Apply the vendor-recommended EOS release for your platform to restore correct handling of IPv4 packets with IP options in the redirection features.

Workarounds

Deploy an ingress access control list that drops or logs IPv4 packets containing IP options at the network edge where such traffic is not required
Layer additional enforcement (firewall, downstream ACL) at the intended redirect destination so a bypass does not permit unfiltered access
Where possible, avoid relying solely on set nexthop redirection for security-critical traffic segmentation until patched

bash

# Example ingress ACL concept to drop IPv4 packets carrying IP options
# Refer to Arista EOS documentation for exact syntax on your platform
ip access-list DROP-IP-OPTIONS
   deny ip any any option any-options
   permit ip any any
!
interface Ethernet1
   ip access-group DROP-IP-OPTIONS in