CVE-2021-28504

Summary

On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol field as expected.

Affected Software

Weaknesses

• CWE-284: CWE-284 Improper Access Control

Workarounds

Replace "vxlan" IP protocol match with match on IP protocol "udp" and Layer 4 destination port for VxLAN encapsulated packets i.e 4789. If VXLAN L4 destination port number is not the default 4789 then use the configured L4 destination port number.

ADP Enrichment

CVE Program Container

Additional References

• https://www.arista.com/en/support/advisories-notices/security-advisories/15267-security-advisory-0073

References

• https://www.arista.com/en/support/advisories-notices/security-advisories/15267-security-advisory-0073

• ←Previous
• Next→