-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                              ESB-2020.2974.3
        Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
                             2 September 2020

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Cisco IOS XR Software
Publisher:         Cisco Systems
Operating System:  Cisco
Impact/Access:     Denial of Service -- Remote/Unauthenticated
Resolution:        Mitigation
CVE Names:         CVE-2020-3569 CVE-2020-3566 

Original Bulletin: 
   https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz

Revision History:  September  2 2020: Clarification of potential of IGMP process 
                                      crashing and updated mitigations section
                   September  1 2020: Cisco has added an additional CVE to advisory 
                                      and removed a mitigation
                   August    31 2020: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities

Priority:        High

Advisory ID:     cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz

First Published: 2020 August 29 03:00 GMT

Last Updated:    2020 September 1 20:02 GMT

Version 2.1:     Interim

Workarounds:     No workarounds available

Cisco Bug IDs:   CSCvr86414CSCvv54838

CVE-2020-3566    
CVE-2020-3569    

CWE-400

Summary

  o Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol
    (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated,
    remote attacker to either immediately crash the Internet Group Management
    Protocol (IGMP) process or make it consume available memory and eventually
    crash. The memory consumption may negatively impact other processes that
    are running on the device.

    These vulnerabilities are due to the incorrect handling of IGMP packets. An
    attacker could exploit these vulnerabilities by sending crafted IGMP
    traffic to an affected device. A successful exploit could allow the
    attacker to immediately crash the IGMP process or cause memory exhaustion,
    resulting in other processes becoming unstable. These processes may
    include, but are not limited to, interior and exterior routing protocols.

    Cisco will release software updates that address these vulnerabilities.
    There are no workarounds that address these vulnerabilities. There are
    multiple mitigations available to customers depending on their needs.

    This advisory is available at the following link:
    https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
    cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz

Affected Products

  o Vulnerable Products

    These vulnerabilities affect any Cisco device that is running any release
    of Cisco IOS XR Software if an active interface is configured under
    multicast routing and it is receiving DVMRP traffic.

    Determine Whether Multicast Routing Is Enabled

    An administrator can determine whether multicast routing is enabled on a
    device by issuing the show igmp interface command. The following output
    shows a device with multicast routing enabled:

        RP/0/0/CPU0:router# show igmp interface

        Loopback0 is up, line protocol is up
          Internet address is 10.144.144.144/32
          IGMP is enabled on interface
          Current IGMP version is 3
          IGMP query interval is 60 seconds
          IGMP querier timeout is 125 seconds
          IGMP max query response time is 10 seconds
          Last member query response interval is 1 seconds
          IGMP activity: 3 joins, 0 leaves
          IGMP querying router is 10.144.144.144 (this system)
        TenGigE0/4/0/0 is up, line protocol is up
          Internet address is 10.114.8.44/24
          IGMP is enabled on interface
          Current IGMP version is 3
          IGMP query interval is 60 seconds
          IGMP querier timeout is 125 seconds
          IGMP max query response time is 10 seconds
          Last member query response interval is 1 seconds
          IGMP activity: 9 joins, 4 leaves
          IGMP querying router is 10.114.8.11

    If the output of show igmp interface is empty, multicast routing is not
    enabled and the device is not affected by these vulnerabilities.

    Determine Whether the Device Is Receiving DVMRP Traffic

    An administrator can determine whether the device is receiving DVMRP
    traffic by issuing the show igmp traffic command. The following output
    shows a device that is receiving DVMRP traffic:

        RP/0/0/CPU0:router#show igmp traffic
        Fri Feb 13 12:00:00.000 UTC

        IGMP Traffic Counters
        Elapsed time since counters cleared: 01:09:27

                                           Received       Sent
        Valid IGMP Packets                   380220        301
        Queries                                   0        143
        Reports                                   0        158
        Leaves                                    0          0
        Mtrace packets                            0          0
        DVMRP packets                        380220          0

    If the DVMRP packets entry contains values of zero in the first column, and
    the counters remain zero on subsequent execution of the command, the device
    is not receiving DVMRP traffic.

    Products Confirmed Not Vulnerable

    Only products listed in the Vulnerable Products section of this advisory
    are known to be affected by these vulnerabilities.

Details

  o These vulnerabilities result in memory exhaustion, which can impact other
    processes on the device. It is possible to recover the memory consumed by
    the IGMP process by restarting the IGMP process with the process restart
    igmp command as follows:

        RP/0/0/CPU0:router# process restart igmp

    In the case of an immediate IGMP process crash, it is not necessary to
    manually restart the IGMP process because the system has already performed
    that action. This automated restart will recover the consumed memory.

    When considering mitigations, it should be understood that for the memory
    exhaustion case, the rate limiter and the access control methods are
    effective. For the immediate IGMP process crash case, only the access
    control method is effective.

Indicators of Compromise

  o When a device is experiencing memory exhaustion based on exploitation of
    these vulnerabilities, the following messages may be seen in the system
    logs:

        RP/0/RSP1/CPU0:Aug 28 03:46:10.375 UTC: raw_ip[399]: %PKT_INFRA-PQMON-6-QUEUE_DROP : Taildrop on XIPC queue 1 owned by igmp (jid=1175)
        RP/0/RSP0/CPU0:Aug 28 03:46:10.380 UTC: raw_ip[399]: %PKT_INFRA-PQMON-6-QUEUE_DROP : Taildrop on XIPC queue 1 owned by igmp (jid=1175)
        RP/0/RSP0/CPU0:Aug 28 03:49:22.850 UTC: dumper[61]: %OS-DUMPER-7-DUMP_REQUEST : Dump request for process pkg/bin/igmp
        RP/0/RSP0/CPU0:Aug 28 03:49:22.851 UTC: dumper[61]: %OS-DUMPER-7-DUMP_ATTRIBUTE : Dump request with attribute 7 for process pkg/bin/igmp
        RP/0/RSP0/CPU0:Aug 28 03:49:22.851 UTC: dumper[61]: %OS-DUMPER-4-SIGSEGV : Thread 9 received SIGSEGV - Segmentation Fault

    When a device has experienced a crash of the IGMP process, the following
    messages may be seen in the system logs:

        RP/0/RSP0/CPU0:Aug 30 17:21:47.653 UTC: igmp[1169]: %HA-HA_WD_LIB-4-RLIMIT : wd_handle_sigxfsz: Reached 90% of RLIMIT_DATA
        RP/0/RSP0/CPU0:Aug 30 17:21:47.653 UTC: igmp[1169]: %ROUTING-IPV4_IGMP-4-OOM_STATE_THROTTLE : Received Critical memory depletion warning, stop creating new igmp state
        RP/0/RSP1/CPU0:Aug 30 17:23:50.442 UTC: sysmgr[94]: igmp(1) (jid 1169) (pid 121667828) (fail_count 2) abnormally terminated, restart scheduled

Workarounds

  o Although there are no workarounds for these vulnerabilities, there are
    multiple mitigations available to customers depending on their needs.

    As a mitigation for the memory exhaustion case, it is recommended that
    customers implement a rate limiter. This will require that customers
    understand their current rate of IGMP traffic and set a rate lower than the
    current average rate. It is worth noting that there is a default limiter in
    place. In configuration mode, the customer can enter the lpts pifib
    hardware police flow igmp rate command as follows:

        RP/0/0/CPU0:router(config)# lpts pifib hardware police flow igmp rate <value> 

    This command will not remove the exploit vector. However, the command will
    reduce the traffic rate and increase the time necessary for successful
    exploitation. The customer can use this time to perform recovery actions.

    As a mitigation for both the memory exhaustion case and the immediate IGMP
    process crash case, customers may implement an access control entry (ACE)
    to an existing interface access control list (ACL). Alternatively, the
    customer can create a new ACL for a specific interface that denies DVMRP
    traffic inbound on that interface. The following example creates an ACL and
    denies DVMRP traffic:

        RP/0/0/CPU0:router(config)# ipv4 access-list <acl_name> deny igmp any any dvmrp

Fixed Software

  o Cisco will release free software updates that address the vulnerabilities
    described in this advisory. Customers may only install and expect support
    for software versions and feature sets for which they have purchased a
    license. By installing, downloading, accessing, or otherwise using such
    software upgrades, customers agree to follow the terms of the Cisco
    software license:
    https://www.cisco.com/c/en/us/products/end-user-license-agreement.html

    Additionally, customers may only download software for which they have a
    valid license, procured from Cisco directly, or through a Cisco authorized
    reseller or partner. In most cases this will be a maintenance upgrade to
    software that was previously purchased. Free security software updates do
    not entitle customers to a new software license, additional software
    feature sets, or major revision upgrades.

    When considering software upgrades , customers are advised to regularly
    consult the advisories for Cisco products, which are available from the
    Cisco Security Advisories page , to determine exposure and a complete
    upgrade solution.

    In all cases, customers should ensure that the devices to be upgraded
    contain sufficient memory and confirm that current hardware and software
    configurations will continue to be supported properly by the new release.
    If the information is not clear, customers are advised to contact the Cisco
    Technical Assistance Center (TAC) or their contracted maintenance
    providers.

    Customers Without Service Contracts

    Customers who purchase directly from Cisco but do not hold a Cisco service
    contract and customers who make purchases through third-party vendors but
    are unsuccessful in obtaining fixed software through their point of sale
    should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c
    /en/us/support/web/tsd-cisco-worldwide-contacts.html

    Customers should have the product serial number available and be prepared
    to provide the URL of this advisory as evidence of entitlement to a free
    upgrade.

    Fixed Releases

    Cisco will release software updates that address these vulnerabilities. As
    fixed releases and SMUs become available, this advisory will be updated.

Exploitation and Public Announcements

  o On August 28, 2020, the Cisco Product Security Incident Response Team
    (PSIRT) became aware of attempted exploitation of these vulnerabilities in
    the wild. For affected products, Cisco recommends implementing a mitigation
    that is appropriate for the customer's environment.

Source

  o These vulnerabilities were found during the resolution of a Cisco TAC
    support case.

Cisco Security Vulnerability Policy

  o To learn about Cisco security vulnerability disclosure policies and
    publications, see the Security Vulnerability Policy . This document also
    contains instructions for obtaining fixed software and receiving security
    vulnerability information from Cisco.

Action Links for This Advisory

  o Snort Rule 54902

URL

  o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
    cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz

Revision History

  o +---------+------------------------+--------------+---------+-------------+
    | Version |      Description       |   Section    | Status  |    Date     |
    +---------+------------------------+--------------+---------+-------------+
    |         | Clarified the          | Summary,     |         |             |
    |         | potential of the IGMP  | Vulnerable   |         |             |
    |         | process crashing.      | Products,    |         |             |
    |         | Added DVMRP traffic    | Details,     |         |             |
    | 2.1     | requirement. Updated   | Indicators   | Interim | 2020-SEP-01 |
    |         | the mitigations        | of           |         |             |
    |         | according to specific  | Compromise,  |         |             |
    |         | exploit outcome.       | and          |         |             |
    |         |                        | Workarounds  |         |             |
    +---------+------------------------+--------------+---------+-------------+
    |         | Added another Cisco    |              |         |             |
    |         | bug ID and CVE ID.     |              |         |             |
    |         | Updated wording        |              |         |             |
    |         | throughout to reflect  |              |         |             |
    |         | multiple               | Header,      |         |             |
    |         | vulnerabilities.       | Vulnerable   |         |             |
    | 2.0     | Corrected a typo in    | Products,    | Interim | 2020-AUG-31 |
    |         | the Determine Whether  | and          |         |             |
    |         | the Device Is          | Workarounds  |         |             |
    |         | Receiving DVMRP        |              |         |             |
    |         | Traffic instructions.  |              |         |             |
    |         | Removed an ineffective |              |         |             |
    |         | mitigation.            |              |         |             |
    +---------+------------------------+--------------+---------+-------------+
    | 1.0     | Initial public         | -            | Interim | 2020-AUG-29 |
    |         | release.               |              |         |             |
    +---------+------------------------+--------------+---------+-------------+

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBX082lONLKJtyKPYoAQhLOw//VNZ6XTS+SseAxacK8Pvyn/Fh7qhLv7e8
jrTeVl5Xc9w0ANfQW/HifmlcDqDlfXkVg5NscufBwI/KG6qSmSx/Qxk0F+XMTX5d
mem6p8H2e7AhjT56ym+DsefnQ1jpk3gYpjhurUy74Mebf0hA1aLOlknjGknrowsU
TxhdiyzoEUpJ4v4GkRiGfE0Rw+xhLbs29iPaLpSu7yx8Hoylh+WFuDAAuDatePR6
SIcX1CS6MVAKLPs4bS/mSAACWp3IMK/Yh0Vj/pXmrfwYgZNZ5j1evrSIVYfYRS8Q
iu2sqyLFV04NCIJJLM+lpt52xKG6FvrnOXlfj9ciIiuXVL29kPXNdr8DdYp7t4yk
UAcHIPG3j0/JCG7lQQXK8UJZMf60x9/XeNrqPubmZkjUylvrnjcw2ao8Ds4Pv363
PolU6BEVgQetl0SLa7l557jJZ+ob+iWh1UMtAj3T3ES5UB8pQoQXw9+B0TGoH9d3
0YipI1cTc7zzjzlg0JQjrQ4qoWFZis5TiDt1P+dPSp4w1S/KlXUSwnCISx9W1V3X
GsoYyx/WLRdKI4KMH6kYlN8Oyty/H+DTUn3J5UDax8b0bHHsSXSTfSjiUBUNYb3x
Xadsym06iXviAPN9Ede8fi2ofeIH+bGYG1xn0CtOAtZmP1AdbMx2ig8nJIDwI1vE
91E4joP01o8=
=7jbC
-----END PGP SIGNATURE-----