CVE-2024-8000
On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restar
- Published
- Updated
- Reserved
- Assigned by
- Arista
Description
On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restart. Note: supplicants with pending captive-portal authentication during ASU would be impacted with this bug.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| AristaCNA (assigner) | 3.1 | Medium5.3 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVDNVD · Deferred | 3.1 | Medium5.3 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.20% · top 90% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.
Weakness
Affected products
- affected 4.32.0 – ≤ 4.32.4M
- affected 4.31.0 – ≤ 4.31.5M
- affected 4.30.0 – ≤ 4.30.8M
What to do
Solution: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades . CVE-2024-8000 has been fixed in the following releases: * 4.33.0M and above * 4.32.5M and above releases in the 4.32.x train * 4.31.6M and above releases in the 4.31.x train * 4.30.9M and above releases in the 4.30.x train
Workaround: The workaround is to re-authenticate each supplicant. This can be done by running the command “dot1x re-authenticate” on the interface post ASU. Alternatively, if the reauthentication timer is enabled, the ACL will be correctly reprogrammed once the timer has expired and re-authentication occurs. switch(Ethernet 1)#dot1x re-authenticate Alternatively, flapping the interface will trigger reauthentication of the supplicants and correct the ACL which is installed for each mac on that interface. switch(Ethernet 1)#shut switch(Ethernet 1)#no shut In both cases mentioned, we can verify that reauth has been triggered by checking the output of `show logging` to show the supplicant has been successfully authenticated and `show ip access-lists` to verify the ACL is installed correctly. switch(Ethernet 1)#show logging Aug 24 07:12:05 switch Dot1x: DOT1X-6-SUPPLICANT_AUTHENTICATED: Supplicant with identity 00:01:02:03:04:05, MAC 0001.0203.0405 and dynamic VLAN None successfully authenticated on port Ethernet1. switch#show ip access-lists Phone ACL bypass: disabled IP Access List 802.1x-3212953518000 [dynamic] 10 deny ip 10.1.0.0/16 20.1.0.0/16 20 permit ip from 11.0.0.0/8 to 12.0.0.0/8 30 permit tcp any any eq 80 40 permit tcp any any eq 443 50 deny ip host 192.168.1.100 Total rules configured: 5 switch#show dot1x hosts mac 0001.203.0405 detail | json { "supplicantMac": "00:01:02:03:04:05", "identity": "user3", "interface": "Ethernet3/47", "authMethod": "EAPOL", "authStage": "SUCCESS", "fallback": "NONE", "callingStationId": "00:01:02:03:04:05", "reauthBehavior": "DO-NOT-RE-AUTH", "reauthInterval": 0, "cacheConfTime": 0, "vlanId": "202", "accountingSessionId": "", "captivePortal": "", "captivePortalSource": "", "aristaWebAuth": "", "supplicantClass": "", "filterId": "", "framedIpAddress": "0.0.0.0", "framedIpAddrSource": "sourceNone", "nasFilterRules": [ "deny in ip from 10.1.0.0/16 to 20.1.0.0/16", "permit in ip from 11.0.0.0/8 to 12.0.0.0/8", "permit tcp any any eq 80", "permit tcp any any eq 443", “deny ip host 192.168.1.100" ], "sessionTimeout": 0, "terminationAction": "", "tunnelPrivateGroupId": "", "aristaPeriodicIdentity": "", "cachedAuthAtLinkDown": false, "reauthTimeoutSeen": false, "sessionCached": false, "detail_": true } In the above example the supplicant has been re-authenticated and the nasFilterRules shows 5 rules, as before.
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-8000)Record last updated .