CVE-2018-0136

Vulnerability

A vulnerability in the IPv6 subsystem of Cisco IOS XR Software Release 5.3.4 for the Cisco Aggregation Services Router (ASR) 9000 Series could allow an unauthenticated, remote attacker to trigger a reload of one or more Trident-based line cards, resulting in a denial of service (DoS) condition [1]. The issue is due to incorrect handling of IPv6 packets with a fragment header extension. The vulnerability exists only when the router is running Cisco IOS XR Software Release 5.3.4 and has Trident-based line cards with IPv6 configured [1].

Exploitation

An unauthenticated, remote attacker can exploit this vulnerability by sending specially crafted IPv6 packets either to or through the Trident-based line card [1]. No authentication or prior access is required; the attacker only needs network connectivity to the affected device.

Impact

A successful exploit triggers a reload of the Trident-based line card(s), causing a denial of service condition during the time the line card takes to restart [1]. The control plane and other line cards may remain operational, but traffic traversing the affected line card is disrupted.

Mitigation

Cisco has made a software maintenance upgrade (SMU) available that addresses this vulnerability. The fix has also been incorporated into service pack 7 for Cisco IOS XR Software Release 5.3.4 [1]. Administrators are advised to upgrade to the fixed software version. No workarounds are mentioned in the advisory.