On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options ma

Description

On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options may bypass the feature's set nexthop action and be slow-path forwarded (FIB routed) by the kernel as the packets are trapped to the CPU instead of following the redirect action's destination.

Scores

EPSS (exploitation in 30 days)

0.53% · top 55% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.8.

Weakness

• cwe-1220

Affected products

• Arista Networks · EOS-Policy Based Routing (PBR)

  • affected 4.32.0F – ≤ 4.32.1F
  • affected 4.31.0M – ≤ 4.31.4M
  • affected 4.30.0M – ≤ 4.30.7M
  • affected 4.29.0M – ≤ 4.29.9M
  • affected 4.28.0M – ≤ 4.28.11M
  • affected 4.27.0M – ≤ 4.27.12M
  • affected 4.26.0M – ≤ 4.26.14M
  • affected 4.25.0M – ≤ 4.25.11M
  • affected 4.24.0M – ≤ 4.24.11M
  • affected 4.23.0M – ≤ 4.23.15M
  • affected 4.22.0M – ≤ 4.22.13M
  • affected 4.21.0M – ≤ 4.21.15M

• Arista Networks · EOS - BGP Flowspec

  • affected 4.32.0F – ≤ 4.32.1F
  • affected 4.31.0M – ≤ 4.31.4M
  • affected 4.30.0M – ≤ 4.30.7M
  • affected 4.29.0M – ≤ 4.29.9M
  • affected 4.28.0M – ≤ 4.28.11M
  • affected 4.27.0M – ≤ 4.27.12M
  • affected 4.26.0M – ≤ 4.26.14M
  • affected 4.25.0M – ≤ 4.25.11M
  • affected 4.24.0M – ≤ 4.24.11M
  • affected 4.23.0M – ≤ 4.23.15M
  • affected 4.22.0M – ≤ 4.22.13M
  • affected 4.21.3F – ≤ 4.21.15M

• Arista Networks · EOS - Interface Traffic Policy

  • affected 4.32.0F – ≤ 4.32.1F
  • affected 4.31.0M – ≤ 4.31.4M
  • affected 4.30.0M – ≤ 4.30.7M
  • affected 4.29.0M – ≤ 4.29.9M
  • affected 4.28.0M – ≤ 4.28.11M
  • affected 4.27.2F – ≤ 4.27.12F

What to do

Solution: The recommended resolution is to upgrade to a remediated software version that contains the ip software forwarding options action drop CLI command, and configure the command at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2024-6437 has been fixed in the following releases: * 4.32.2F and later releases in the 4.32.x train * 4.31.5M and later releases in the 4.31.x train * 4.30.8M and later releases in the 4.30.x train * 4.29.10M and later releases in the 4.29.x train

Workaround: For all affected systems, the suggested mitigation for all three affected features is to drop all IPv4 options traffic via the ip software forwarding options action drop, available in 4.32.2F and later releases in the 4.32 train, 4.31.5M and later releases in the 4.31 train, and 4.30.8M and later releases in the 4.30 train. The command installs an iptables rule that drops all IPv4 options traffic in the filter table of the FORWARD chain. switch(config)#ip software forwarding options action drop # Below is shown to illustrate what the rule does. This is not a command that needs to be run. switch(config)#bash sudo iptables -vnL EOS_FORWARD Chain EOS_FORWARD (1 references)  pkts bytes target     prot opt in     out     source               destination     0     0 DROP       all -- *     *       0.0.0.0/0           0.0.0.0/0           u32 ! "0x0>>0x18=0x45"     0     0 REJECT     all -- *     fwd+   0.0.0.0/0           0.0.0.0/0           u32 ! "0x0>>0x18=0x45" reject-with icmp-admin-prohibited     0     0 DROP       all -- *     ma+     0.0.0.0/0           0.0.0.0/0     0     0 ACCEPT     all -- *     *     !127.0.0.0/8         !127.0.0.0/8   Additionally, in 7280R3, 7500R3, and 7800R3 systems, the system-rule overriding-action redirect command (present in EOS-4.28.0F and newer releases) can be used to allow for all of the affected features' set nexthop action to take precedence over the system ACL's trap action to CPU. See TCAM redirect action overriding system rules - TOI https://www.arista.com/en/support/toi/eos-4-28-0f/15280-tcam-redirect-action-overriding-system-rules  for more information.

References (1)

• https://www.arista.com/en/support/advisories-notices/security-advisory/20689-security-advisory-0108 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2024-6437](https://trackcve.app/badge/CVE-2024-6437.svg)](https://trackcve.app/cve/CVE-2024-6437)

Record last updated 10 Jan 2025, 21:12 UTC.