Arista EOS Tunnel Protocol Type Verification Bypass in Decapsulation

Successful exploitation allows unexpected tunneled traffic to be accepted, decapsulated, and forwarded into internal network segments behind the switch, bypassing the intended restriction that only configured tunnel protocols should be processed. This can expose internal networks to unauthorized traffic delivery and policy bypass at the tunnel boundary. Arista and CISA report that the issue has been exploited in the wild.

Mitigate by filtering tunnel traffic so that only expected tunnel protocols destined for the configured decapsulation IP are permitted. Arista recommends either: (1) applying ACLs on upstream devices before traffic reaches the decapsulation endpoint, or (2) applying ACLs directly on the decapsulation switch. Filtering should be based on destination IP, protocol, and where applicable UDP port, to selectively allow legitimate tunnel traffic or block unexpected tunnel types. On 7020R Series, 7280R/R2 Series, and 7500R/R2 Series, mitigation on the decapsulation switch requires MAC ACLs plus TCAM profile updates using User Defined Fields. On 7280R3 Series, 7500R3 Series, and 7800R3 Series, mitigation on the decapsulation switch requires IPv6 PACLs and TCAM profile updates.

Arista states that no software fix, hotfix, or upgrade path is planned for this issue because changing the behavior could break existing deployments and configurations. Customers requiring assistance are directed to contact Arista TAC.