CVE-2024-8000 (GCVE-0-2024-8000)
Vulnerability from cvelistv5
Published
2025-03-04 20:20
Modified
2025-03-04 20:33
Severity ?
5.3 (Medium) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE
  • CWE-1284 - Improper Validation of Specified Quantity in Input
Summary
On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restart. Note: supplicants with pending captive-portal authentication during ASU would be impacted with this bug.
References
psirt@arista.comhttps://www.arista.com/en/support/advisories-notices/security-advisory/21086-security-advisory-0109
Impacted products
Vendor Product Version
Arista Networks EOS Version: 4.32.0   <
Version: 4.31.0   <
Version: 4.30.0   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8000",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-04T20:33:23.880423Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-04T20:33:37.805Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "lessThanOrEqual": "4.32.4M",
              "status": "affected",
              "version": "4.32.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.31.5M",
              "status": "affected",
              "version": "4.31.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.30.8M",
              "status": "affected",
              "version": "4.30.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn order to be vulnerable to CVE-2024-8000, the following three conditions must be met:\u003c/p\u003e\u003col\u003e\u003cli\u003e802.1X must be configured.\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003c/li\u003e\u003cli\u003eThe customer must have an external AAA server configured which sends a multi-line dynamic ACL.\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003c/li\u003e\u003cli\u003eASU must have occurred ( more information about the upgrade process can be found here at \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\"\u003eUpgrades and Downgrades - Arista\u003c/a\u003e\u0026nbsp;). The version being upgraded from is an affected software version, and the version being upgraded to is an affected software version as listed above. \u003c/li\u003e\u003c/ol\u003e\u003cp\u003eThe below example shows an example of this issue before and after ASU:\u003c/p\u003e\u003cpre\u003eswitch#show dot1x hosts mac 0001.0203.0405 detail | json\n{\n\u0026nbsp; \u0026nbsp; \"supplicantMac\": \"00:01:02:03:04:05\",\n\u0026nbsp; \u0026nbsp; \"identity\": \"user3\",\n\u0026nbsp; \u0026nbsp; \"interface\": \"Ethernet3/47\",\n\u0026nbsp; \u0026nbsp; \"authMethod\": \"EAPOL\",\n\u0026nbsp; \u0026nbsp; \"authStage\": \"SUCCESS\",\n\u0026nbsp; \u0026nbsp; \"fallback\": \"NONE\",\n\u0026nbsp; \u0026nbsp; \"callingStationId\": \"00-01-02-03-04-05\",\n\u0026nbsp; \u0026nbsp; \"reauthBehavior\": \"DO-NOT-RE-AUTH\",\n\u0026nbsp; \u0026nbsp; \"reauthInterval\": 0,\n\u0026nbsp; \u0026nbsp; \"cacheConfTime\": 0,\n\u0026nbsp; \u0026nbsp; \"vlanId\": \"202\",\n\u0026nbsp; \u0026nbsp; \"accountingSessionId\": \"\",\n\u0026nbsp; \u0026nbsp; \"captivePortal\": \"\",\n\u0026nbsp; \u0026nbsp; \"captivePortalSource\": \"\",\n\u0026nbsp; \u0026nbsp; \"aristaWebAuth\": \"\",\n\u0026nbsp; \u0026nbsp; \"supplicantClass\": \"\",\n\u0026nbsp; \u0026nbsp; \"filterId\": \"\",\n\u0026nbsp; \u0026nbsp; \"framedIpAddress\": \"0.0.0.0\",\n\u0026nbsp; \u0026nbsp; \"framedIpAddrSource\": \"sourceNone\",\n    \u003cspan style=\"background-color: rgb(255, 255, 0);\"\u003e\u003cb\u003e\"nasFilterRules\":  [\u003c/b\u003e\n\u003cb\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \"deny in ip from 10.1.0.0/16 to 20.1.0.0/16\",\u003c/b\u003e\n\u003cb\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \"permit in ip from 11.0.0.0/8 to 12.0.0.0/8\",\u003c/b\u003e\n\u003cb\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \"permit tcp any any eq 80\", \u003c/b\u003e\n\u003cb\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \"permit tcp any any eq 443\",\u003c/b\u003e\n\u003cb\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u201cdeny ip host 192.168.1.100\"\u003c/b\u003e\n    \u003cb\u003e],\u003c/b\u003e\u003c/span\u003e\n\u0026nbsp; \u0026nbsp; \"sessionTimeout\": 0,\n\u0026nbsp; \u0026nbsp; \"terminationAction\": \"\",\n\u0026nbsp; \u0026nbsp; \"tunnelPrivateGroupId\": \"\",\n\u0026nbsp; \u0026nbsp; \"aristaPeriodicIdentity\": \"\",\n\u0026nbsp; \u0026nbsp; \"cachedAuthAtLinkDown\": false,\n\u0026nbsp; \u0026nbsp; \"reauthTimeoutSeen\": false,\n\u0026nbsp; \u0026nbsp; \"sessionCached\": false,\n\u0026nbsp; \u0026nbsp; \"detail_\": true\n}\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eThe above example is before ASU. Note that the \u201cnasFilterRules\u201d has 5 rules in it.\u003c/p\u003e\u003cp\u003eWhen ASU is performed:\u003c/p\u003e\u003cpre\u003eswitch#show dot1x hosts mac 0001.0203.0405 detail | json\n{\n\u0026nbsp; \u0026nbsp; \"supplicantMac\": \"00:01:02:03:04:05\",\n\u0026nbsp; \u0026nbsp; \"identity\": \"user3\",\n\u0026nbsp; \u0026nbsp; \"interface\": \"Ethernet3/47\",\n\u0026nbsp; \u0026nbsp; \"authMethod\": \"EAPOL\",\n\u0026nbsp; \u0026nbsp; \"authStage\": \"SUCCESS\",\n\u0026nbsp; \u0026nbsp; \"fallback\": \"NONE\",\n\u0026nbsp; \u0026nbsp; \"callingStationId\": \"00-01-02-03-04-05\",\n\u0026nbsp; \u0026nbsp; \"reauthBehavior\": \"DO-NOT-RE-AUTH\",\n\u0026nbsp; \u0026nbsp; \"reauthInterval\": 0,\n\u0026nbsp; \u0026nbsp; \"cacheConfTime\": 0,\n\u0026nbsp; \u0026nbsp; \"vlanId\": \"202\",\n\u0026nbsp; \u0026nbsp; \"accountingSessionId\": \"\",\n\u0026nbsp; \u0026nbsp; \"captivePortal\": \"\",\n\u0026nbsp; \u0026nbsp; \"captivePortalSource\": \"\",\n\u0026nbsp; \u0026nbsp; \"aristaWebAuth\": \"\",\n\u0026nbsp; \u0026nbsp; \"supplicantClass\": \"\",\n\u0026nbsp; \u0026nbsp; \"filterId\": \"\",\n\u0026nbsp; \u0026nbsp; \"framedIpAddress\": \"0.0.0.0\",\n\u0026nbsp; \u0026nbsp; \"framedIpAddrSource\": \"sourceNone\",\n     \u003cspan style=\"background-color: rgb(255, 255, 0);\"\u003e\u003cb\u003e\"nasFilterRules\": [\u003c/b\u003e\n\u003cb\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \"deny in ip from 10.1.0.0/16 to 20.1.0.0/16\"\u003c/b\u003e\n    \u003cb\u003e],\u003c/b\u003e\u003c/span\u003e\n\u0026nbsp; \u0026nbsp; \"sessionTimeout\": 0,\n\u0026nbsp; \u0026nbsp; \"terminationAction\": \"\",\n\u0026nbsp; \u0026nbsp; \"tunnelPrivateGroupId\": \"\",\n\u0026nbsp; \u0026nbsp; \"aristaPeriodicIdentity\": \"\",\n\u0026nbsp; \u0026nbsp; \"cachedAuthAtLinkDown\": false,\n\u0026nbsp; \u0026nbsp; \"reauthTimeoutSeen\": false,\n\u0026nbsp; \u0026nbsp; \"sessionCached\": false,\n\u0026nbsp; \u0026nbsp; \"detail_\": true\n}\n\u003c/pre\u003e\u003cp\u003eThe above example is after ASU. Note the nasFilterRule is now only one line. \u003c/p\u003e\u003cp\u003eNote: This symptom is not present when a non-ASU upgrade (i.e. standard reboot) takes place.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "In order to be vulnerable to CVE-2024-8000, the following three conditions must be met:\n\n  *  802.1X must be configured.\u00a0\n\n\n  *  The customer must have an external AAA server configured which sends a multi-line dynamic ACL.\u00a0\n\n\n  *  ASU must have occurred ( more information about the upgrade process can be found here at  Upgrades and Downgrades - Arista https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades \u00a0). The version being upgraded from is an affected software version, and the version being upgraded to is an affected software version as listed above. \nThe below example shows an example of this issue before and after ASU:\n\nswitch#show dot1x hosts mac 0001.0203.0405 detail | json\n{\n\u00a0 \u00a0 \"supplicantMac\": \"00:01:02:03:04:05\",\n\u00a0 \u00a0 \"identity\": \"user3\",\n\u00a0 \u00a0 \"interface\": \"Ethernet3/47\",\n\u00a0 \u00a0 \"authMethod\": \"EAPOL\",\n\u00a0 \u00a0 \"authStage\": \"SUCCESS\",\n\u00a0 \u00a0 \"fallback\": \"NONE\",\n\u00a0 \u00a0 \"callingStationId\": \"00-01-02-03-04-05\",\n\u00a0 \u00a0 \"reauthBehavior\": \"DO-NOT-RE-AUTH\",\n\u00a0 \u00a0 \"reauthInterval\": 0,\n\u00a0 \u00a0 \"cacheConfTime\": 0,\n\u00a0 \u00a0 \"vlanId\": \"202\",\n\u00a0 \u00a0 \"accountingSessionId\": \"\",\n\u00a0 \u00a0 \"captivePortal\": \"\",\n\u00a0 \u00a0 \"captivePortalSource\": \"\",\n\u00a0 \u00a0 \"aristaWebAuth\": \"\",\n\u00a0 \u00a0 \"supplicantClass\": \"\",\n\u00a0 \u00a0 \"filterId\": \"\",\n\u00a0 \u00a0 \"framedIpAddress\": \"0.0.0.0\",\n\u00a0 \u00a0 \"framedIpAddrSource\": \"sourceNone\",\n    \"nasFilterRules\":  [\n\u00a0 \u00a0 \u00a0 \u00a0 \"deny in ip from 10.1.0.0/16 to 20.1.0.0/16\",\n\u00a0 \u00a0 \u00a0 \u00a0 \"permit in ip from 11.0.0.0/8 to 12.0.0.0/8\",\n\u00a0 \u00a0 \u00a0 \u00a0 \"permit tcp any any eq 80\", \n\u00a0 \u00a0 \u00a0 \u00a0 \"permit tcp any any eq 443\",\n\u00a0 \u00a0 \u00a0 \u00a0 \u201cdeny ip host 192.168.1.100\"\n    ],\n\u00a0 \u00a0 \"sessionTimeout\": 0,\n\u00a0 \u00a0 \"terminationAction\": \"\",\n\u00a0 \u00a0 \"tunnelPrivateGroupId\": \"\",\n\u00a0 \u00a0 \"aristaPeriodicIdentity\": \"\",\n\u00a0 \u00a0 \"cachedAuthAtLinkDown\": false,\n\u00a0 \u00a0 \"reauthTimeoutSeen\": false,\n\u00a0 \u00a0 \"sessionCached\": false,\n\u00a0 \u00a0 \"detail_\": true\n}\n\n\n\u00a0\n\nThe above example is before ASU. Note that the \u201cnasFilterRules\u201d has 5 rules in it.\n\nWhen ASU is performed:\n\nswitch#show dot1x hosts mac 0001.0203.0405 detail | json\n{\n\u00a0 \u00a0 \"supplicantMac\": \"00:01:02:03:04:05\",\n\u00a0 \u00a0 \"identity\": \"user3\",\n\u00a0 \u00a0 \"interface\": \"Ethernet3/47\",\n\u00a0 \u00a0 \"authMethod\": \"EAPOL\",\n\u00a0 \u00a0 \"authStage\": \"SUCCESS\",\n\u00a0 \u00a0 \"fallback\": \"NONE\",\n\u00a0 \u00a0 \"callingStationId\": \"00-01-02-03-04-05\",\n\u00a0 \u00a0 \"reauthBehavior\": \"DO-NOT-RE-AUTH\",\n\u00a0 \u00a0 \"reauthInterval\": 0,\n\u00a0 \u00a0 \"cacheConfTime\": 0,\n\u00a0 \u00a0 \"vlanId\": \"202\",\n\u00a0 \u00a0 \"accountingSessionId\": \"\",\n\u00a0 \u00a0 \"captivePortal\": \"\",\n\u00a0 \u00a0 \"captivePortalSource\": \"\",\n\u00a0 \u00a0 \"aristaWebAuth\": \"\",\n\u00a0 \u00a0 \"supplicantClass\": \"\",\n\u00a0 \u00a0 \"filterId\": \"\",\n\u00a0 \u00a0 \"framedIpAddress\": \"0.0.0.0\",\n\u00a0 \u00a0 \"framedIpAddrSource\": \"sourceNone\",\n     \"nasFilterRules\": [\n\u00a0 \u00a0 \u00a0 \u00a0 \"deny in ip from 10.1.0.0/16 to 20.1.0.0/16\"\n    ],\n\u00a0 \u00a0 \"sessionTimeout\": 0,\n\u00a0 \u00a0 \"terminationAction\": \"\",\n\u00a0 \u00a0 \"tunnelPrivateGroupId\": \"\",\n\u00a0 \u00a0 \"aristaPeriodicIdentity\": \"\",\n\u00a0 \u00a0 \"cachedAuthAtLinkDown\": false,\n\u00a0 \u00a0 \"reauthTimeoutSeen\": false,\n\u00a0 \u00a0 \"sessionCached\": false,\n\u00a0 \u00a0 \"detail_\": true\n}\n\n\nThe above example is after ASU. Note the nasFilterRule is now only one line. \n\nNote: This symptom is not present when a non-ASU upgrade (i.e. standard reboot) takes place."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOn affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restart. \u003c/p\u003e\u003cp\u003eNote: supplicants with pending captive-portal authentication during ASU would be impacted with this bug.\u003c/p\u003e"
            }
          ],
          "value": "On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restart. \n\nNote: supplicants with pending captive-portal authentication during ASU would be impacted with this bug."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-04T20:20:53.517Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/21086-security-advisory-0109"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\"\u003eEOS User Manual: Upgrades and Downgrades\u003c/a\u003e. \u003c/p\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cdiv\u003eCVE-2024-8000 has been fixed in the following releases:\u003c/div\u003e\u003cul\u003e\u003cli\u003e4.33.0M and above\u003c/li\u003e\u003cli\u003e4.32.5M and above releases in the 4.32.x train\u003c/li\u003e\u003cli\u003e4.31.6M and above releases in the 4.31.x train\u003c/li\u003e\u003cli\u003e4.30.9M and above releases in the 4.30.x train\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e"
            }
          ],
          "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see  EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades . \n\n\u00a0\n\nCVE-2024-8000 has been fixed in the following releases:\n\n  *  4.33.0M and above\n  *  4.32.5M and above releases in the 4.32.x train\n  *  4.31.6M and above releases in the 4.31.x train\n  *  4.30.9M and above releases in the 4.30.x train"
        }
      ],
      "source": {
        "advisory": "109",
        "defect": [
          "989881"
        ],
        "discovery": "INTERNAL"
      },
      "title": "On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restar",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe workaround is to re-authenticate each supplicant. This can be done by running the command \u201c\u003cb\u003edot1x re-authenticate\u003c/b\u003e\u201d on the interface post ASU. Alternatively, if the reauthentication timer is enabled, the ACL will be correctly reprogrammed once the timer has expired and re-authentication occurs. \u003c/p\u003e\u003cpre\u003eswitch(Ethernet 1)#dot1x re-authenticate\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eAlternatively, flapping the interface will trigger reauthentication of the supplicants and correct the ACL which is installed for each mac on that interface.\u003c/p\u003e\u003cpre\u003eswitch(Ethernet 1)#shut\nswitch(Ethernet 1)#no shut\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eIn both cases mentioned, we can verify that reauth has been triggered by checking the output of `\u003cb\u003eshow logging\u003c/b\u003e` to show the supplicant has been successfully authenticated and `\u003cb\u003eshow ip access-lists\u003c/b\u003e` to verify the ACL is installed correctly. \u003c/p\u003e\u003cpre\u003eswitch(Ethernet 1)#show logging\nAug 24 07:12:05 switch Dot1x: DOT1X-6-SUPPLICANT_AUTHENTICATED: Supplicant with identity 00:01:02:03:04:05, MAC 0001.0203.0405 and dynamic VLAN None successfully authenticated on port Ethernet1.\n  \nswitch#show ip access-lists\nPhone ACL bypass: disabled\nIP Access List 802.1x-3212953518000 [dynamic]\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 10 deny ip 10.1.0.0/16 20.1.0.0/16\n     \u0026nbsp; \u0026nbsp;20 permit ip from 11.0.0.0/8 to 12.0.0.0/8\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 30 permit tcp any any eq 80\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 40 permit tcp any any eq 443\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 50 deny ip host 192.168.1.100\n  \n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Total rules configured: 5\n  \nswitch#show dot1x hosts mac 0001.203.0405 detail | json\n{\n\u0026nbsp; \u0026nbsp; \"supplicantMac\": \"00:01:02:03:04:05\",\n\u0026nbsp; \u0026nbsp; \"identity\": \"user3\",\n\u0026nbsp; \u0026nbsp; \"interface\": \"Ethernet3/47\",\n\u0026nbsp; \u0026nbsp; \"authMethod\": \"EAPOL\",\n\u0026nbsp; \u0026nbsp; \"authStage\": \"SUCCESS\",\n\u0026nbsp; \u0026nbsp; \"fallback\": \"NONE\",\n\u0026nbsp; \u0026nbsp; \"callingStationId\": \"00:01:02:03:04:05\",\n\u0026nbsp; \u0026nbsp; \"reauthBehavior\": \"DO-NOT-RE-AUTH\",\n\u0026nbsp; \u0026nbsp; \"reauthInterval\": 0,\n\u0026nbsp; \u0026nbsp; \"cacheConfTime\": 0,\n\u0026nbsp; \u0026nbsp; \"vlanId\": \"202\",\n\u0026nbsp; \u0026nbsp; \"accountingSessionId\": \"\",\n\u0026nbsp; \u0026nbsp; \"captivePortal\": \"\",\n\u0026nbsp; \u0026nbsp; \"captivePortalSource\": \"\",\n\u0026nbsp; \u0026nbsp; \"aristaWebAuth\": \"\",\n\u0026nbsp; \u0026nbsp; \"supplicantClass\": \"\",\n\u0026nbsp; \u0026nbsp; \"filterId\": \"\",\n\u0026nbsp; \u0026nbsp; \"framedIpAddress\": \"0.0.0.0\",\n\u0026nbsp; \u0026nbsp; \"framedIpAddrSource\": \"sourceNone\",\n\u0026nbsp; \u0026nbsp; \u003cspan style=\"background-color: rgb(255, 255, 0);\"\u003e\"nasFilterRules\": [\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \"deny in ip from 10.1.0.0/16 to 20.1.0.0/16\",\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \"permit in ip from 11.0.0.0/8 to 12.0.0.0/8\",\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \"permit tcp any any eq 80\",\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \"permit tcp any any eq 443\",\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u201cdeny ip host 192.168.1.100\"\n\u0026nbsp; \u0026nbsp; ],\u003c/span\u003e\n\u0026nbsp; \u0026nbsp; \"sessionTimeout\": 0,\n\u0026nbsp; \u0026nbsp; \"terminationAction\": \"\",\n\u0026nbsp; \u0026nbsp; \"tunnelPrivateGroupId\": \"\",\n\u0026nbsp; \u0026nbsp; \"aristaPeriodicIdentity\": \"\",\n\u0026nbsp; \u0026nbsp; \"cachedAuthAtLinkDown\": false,\n\u0026nbsp; \u0026nbsp; \"reauthTimeoutSeen\": false,\n\u0026nbsp; \u0026nbsp; \"sessionCached\": false,\n\u0026nbsp; \u0026nbsp; \"detail_\": true\n}\u003c/pre\u003e\u003cp\u003eIn the above example the supplicant has been re-authenticated and the nasFilterRules shows 5 rules, as before.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "The workaround is to re-authenticate each supplicant. This can be done by running the command \u201cdot1x re-authenticate\u201d on the interface post ASU. Alternatively, if the reauthentication timer is enabled, the ACL will be correctly reprogrammed once the timer has expired and re-authentication occurs. \n\nswitch(Ethernet 1)#dot1x re-authenticate\n\n\n\u00a0\n\nAlternatively, flapping the interface will trigger reauthentication of the supplicants and correct the ACL which is installed for each mac on that interface.\n\nswitch(Ethernet 1)#shut\nswitch(Ethernet 1)#no shut\n\n\n\u00a0\n\nIn both cases mentioned, we can verify that reauth has been triggered by checking the output of `show logging` to show the supplicant has been successfully authenticated and `show ip access-lists` to verify the ACL is installed correctly. \n\nswitch(Ethernet 1)#show logging\nAug 24 07:12:05 switch Dot1x: DOT1X-6-SUPPLICANT_AUTHENTICATED: Supplicant with identity 00:01:02:03:04:05, MAC 0001.0203.0405 and dynamic VLAN None successfully authenticated on port Ethernet1.\n  \nswitch#show ip access-lists\nPhone ACL bypass: disabled\nIP Access List 802.1x-3212953518000 [dynamic]\n\u00a0 \u00a0 \u00a0 \u00a0 10 deny ip 10.1.0.0/16 20.1.0.0/16\n     \u00a0 \u00a020 permit ip from 11.0.0.0/8 to 12.0.0.0/8\n\u00a0 \u00a0 \u00a0 \u00a0 30 permit tcp any any eq 80\n\u00a0 \u00a0 \u00a0 \u00a0 40 permit tcp any any eq 443\n\u00a0 \u00a0 \u00a0 \u00a0 50 deny ip host 192.168.1.100\n  \n\u00a0 \u00a0 \u00a0 \u00a0 Total rules configured: 5\n  \nswitch#show dot1x hosts mac 0001.203.0405 detail | json\n{\n\u00a0 \u00a0 \"supplicantMac\": \"00:01:02:03:04:05\",\n\u00a0 \u00a0 \"identity\": \"user3\",\n\u00a0 \u00a0 \"interface\": \"Ethernet3/47\",\n\u00a0 \u00a0 \"authMethod\": \"EAPOL\",\n\u00a0 \u00a0 \"authStage\": \"SUCCESS\",\n\u00a0 \u00a0 \"fallback\": \"NONE\",\n\u00a0 \u00a0 \"callingStationId\": \"00:01:02:03:04:05\",\n\u00a0 \u00a0 \"reauthBehavior\": \"DO-NOT-RE-AUTH\",\n\u00a0 \u00a0 \"reauthInterval\": 0,\n\u00a0 \u00a0 \"cacheConfTime\": 0,\n\u00a0 \u00a0 \"vlanId\": \"202\",\n\u00a0 \u00a0 \"accountingSessionId\": \"\",\n\u00a0 \u00a0 \"captivePortal\": \"\",\n\u00a0 \u00a0 \"captivePortalSource\": \"\",\n\u00a0 \u00a0 \"aristaWebAuth\": \"\",\n\u00a0 \u00a0 \"supplicantClass\": \"\",\n\u00a0 \u00a0 \"filterId\": \"\",\n\u00a0 \u00a0 \"framedIpAddress\": \"0.0.0.0\",\n\u00a0 \u00a0 \"framedIpAddrSource\": \"sourceNone\",\n\u00a0 \u00a0 \"nasFilterRules\": [\n\u00a0 \u00a0 \u00a0 \u00a0 \"deny in ip from 10.1.0.0/16 to 20.1.0.0/16\",\n\u00a0 \u00a0 \u00a0 \u00a0 \"permit in ip from 11.0.0.0/8 to 12.0.0.0/8\",\n\u00a0 \u00a0 \u00a0 \u00a0 \"permit tcp any any eq 80\",\n\u00a0 \u00a0 \u00a0 \u00a0 \"permit tcp any any eq 443\",\n\u00a0 \u00a0 \u00a0 \u00a0 \u201cdeny ip host 192.168.1.100\"\n\u00a0 \u00a0 ],\n\u00a0 \u00a0 \"sessionTimeout\": 0,\n\u00a0 \u00a0 \"terminationAction\": \"\",\n\u00a0 \u00a0 \"tunnelPrivateGroupId\": \"\",\n\u00a0 \u00a0 \"aristaPeriodicIdentity\": \"\",\n\u00a0 \u00a0 \"cachedAuthAtLinkDown\": false,\n\u00a0 \u00a0 \"reauthTimeoutSeen\": false,\n\u00a0 \u00a0 \"sessionCached\": false,\n\u00a0 \u00a0 \"detail_\": true\n}\n\nIn the above example the supplicant has been re-authenticated and the nasFilterRules shows 5 rules, as before."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2024-8000",
    "datePublished": "2025-03-04T20:20:53.517Z",
    "dateReserved": "2024-08-19T23:25:41.372Z",
    "dateUpdated": "2025-03-04T20:33:37.805Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-8000\",\"sourceIdentifier\":\"psirt@arista.com\",\"published\":\"2025-03-04T21:15:12.220\",\"lastModified\":\"2025-03-04T21:15:12.220\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restart. \\n\\nNote: supplicants with pending captive-portal authentication during ASU would be impacted with this bug.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1284\"}]}],\"references\":[{\"url\":\"https://www.arista.com/en/support/advisories-notices/security-advisory/21086-security-advisory-0109\",\"source\":\"psirt@arista.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-8000\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-04T20:33:23.880423Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-04T20:33:31.194Z\"}}], \"cna\": {\"title\": \"On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restar\", \"source\": {\"defect\": [\"989881\"], \"advisory\": \"109\", \"discovery\": \"INTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-115\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-115 Authentication Bypass\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Arista Networks\", \"product\": \"EOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.32.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.32.4M\"}, {\"status\": \"affected\", \"version\": \"4.31.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.31.5M\"}, {\"status\": \"affected\", \"version\": \"4.30.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.30.8M\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see  EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades . \\n\\n\\u00a0\\n\\nCVE-2024-8000 has been fixed in the following releases:\\n\\n  *  4.33.0M and above\\n  *  4.32.5M and above releases in the 4.32.x train\\n  *  4.31.6M and above releases in the 4.31.x train\\n  *  4.30.9M and above releases in the 4.30.x train\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\\\"\u003eEOS User Manual: Upgrades and Downgrades\u003c/a\u003e. \u003c/p\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cdiv\u003eCVE-2024-8000 has been fixed in the following releases:\u003c/div\u003e\u003cul\u003e\u003cli\u003e4.33.0M and above\u003c/li\u003e\u003cli\u003e4.32.5M and above releases in the 4.32.x train\u003c/li\u003e\u003cli\u003e4.31.6M and above releases in the 4.31.x train\u003c/li\u003e\u003cli\u003e4.30.9M and above releases in the 4.30.x train\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisory/21086-security-advisory-0109\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"The workaround is to re-authenticate each supplicant. This can be done by running the command \\u201cdot1x re-authenticate\\u201d on the interface post ASU. Alternatively, if the reauthentication timer is enabled, the ACL will be correctly reprogrammed once the timer has expired and re-authentication occurs. \\n\\nswitch(Ethernet 1)#dot1x re-authenticate\\n\\n\\n\\u00a0\\n\\nAlternatively, flapping the interface will trigger reauthentication of the supplicants and correct the ACL which is installed for each mac on that interface.\\n\\nswitch(Ethernet 1)#shut\\nswitch(Ethernet 1)#no shut\\n\\n\\n\\u00a0\\n\\nIn both cases mentioned, we can verify that reauth has been triggered by checking the output of `show logging` to show the supplicant has been successfully authenticated and `show ip access-lists` to verify the ACL is installed correctly. \\n\\nswitch(Ethernet 1)#show logging\\nAug 24 07:12:05 switch Dot1x: DOT1X-6-SUPPLICANT_AUTHENTICATED: Supplicant with identity 00:01:02:03:04:05, MAC 0001.0203.0405 and dynamic VLAN None successfully authenticated on port Ethernet1.\\n  \\nswitch#show ip access-lists\\nPhone ACL bypass: disabled\\nIP Access List 802.1x-3212953518000 [dynamic]\\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 10 deny ip 10.1.0.0/16 20.1.0.0/16\\n     \\u00a0 \\u00a020 permit ip from 11.0.0.0/8 to 12.0.0.0/8\\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 30 permit tcp any any eq 80\\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 40 permit tcp any any eq 443\\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 50 deny ip host 192.168.1.100\\n  \\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 Total rules configured: 5\\n  \\nswitch#show dot1x hosts mac 0001.203.0405 detail | json\\n{\\n\\u00a0 \\u00a0 \\\"supplicantMac\\\": \\\"00:01:02:03:04:05\\\",\\n\\u00a0 \\u00a0 \\\"identity\\\": \\\"user3\\\",\\n\\u00a0 \\u00a0 \\\"interface\\\": \\\"Ethernet3/47\\\",\\n\\u00a0 \\u00a0 \\\"authMethod\\\": \\\"EAPOL\\\",\\n\\u00a0 \\u00a0 \\\"authStage\\\": \\\"SUCCESS\\\",\\n\\u00a0 \\u00a0 \\\"fallback\\\": \\\"NONE\\\",\\n\\u00a0 \\u00a0 \\\"callingStationId\\\": \\\"00:01:02:03:04:05\\\",\\n\\u00a0 \\u00a0 \\\"reauthBehavior\\\": \\\"DO-NOT-RE-AUTH\\\",\\n\\u00a0 \\u00a0 \\\"reauthInterval\\\": 0,\\n\\u00a0 \\u00a0 \\\"cacheConfTime\\\": 0,\\n\\u00a0 \\u00a0 \\\"vlanId\\\": \\\"202\\\",\\n\\u00a0 \\u00a0 \\\"accountingSessionId\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"captivePortal\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"captivePortalSource\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"aristaWebAuth\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"supplicantClass\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"filterId\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"framedIpAddress\\\": \\\"0.0.0.0\\\",\\n\\u00a0 \\u00a0 \\\"framedIpAddrSource\\\": \\\"sourceNone\\\",\\n\\u00a0 \\u00a0 \\\"nasFilterRules\\\": [\\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 \\\"deny in ip from 10.1.0.0/16 to 20.1.0.0/16\\\",\\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 \\\"permit in ip from 11.0.0.0/8 to 12.0.0.0/8\\\",\\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 \\\"permit tcp any any eq 80\\\",\\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 \\\"permit tcp any any eq 443\\\",\\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 \\u201cdeny ip host 192.168.1.100\\\"\\n\\u00a0 \\u00a0 ],\\n\\u00a0 \\u00a0 \\\"sessionTimeout\\\": 0,\\n\\u00a0 \\u00a0 \\\"terminationAction\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"tunnelPrivateGroupId\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"aristaPeriodicIdentity\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"cachedAuthAtLinkDown\\\": false,\\n\\u00a0 \\u00a0 \\\"reauthTimeoutSeen\\\": false,\\n\\u00a0 \\u00a0 \\\"sessionCached\\\": false,\\n\\u00a0 \\u00a0 \\\"detail_\\\": true\\n}\\n\\nIn the above example the supplicant has been re-authenticated and the nasFilterRules shows 5 rules, as before.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe workaround is to re-authenticate each supplicant. This can be done by running the command \\u201c\u003cb\u003edot1x re-authenticate\u003c/b\u003e\\u201d on the interface post ASU. Alternatively, if the reauthentication timer is enabled, the ACL will be correctly reprogrammed once the timer has expired and re-authentication occurs. \u003c/p\u003e\u003cpre\u003eswitch(Ethernet 1)#dot1x re-authenticate\\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eAlternatively, flapping the interface will trigger reauthentication of the supplicants and correct the ACL which is installed for each mac on that interface.\u003c/p\u003e\u003cpre\u003eswitch(Ethernet 1)#shut\\nswitch(Ethernet 1)#no shut\\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eIn both cases mentioned, we can verify that reauth has been triggered by checking the output of `\u003cb\u003eshow logging\u003c/b\u003e` to show the supplicant has been successfully authenticated and `\u003cb\u003eshow ip access-lists\u003c/b\u003e` to verify the ACL is installed correctly. \u003c/p\u003e\u003cpre\u003eswitch(Ethernet 1)#show logging\\nAug 24 07:12:05 switch Dot1x: DOT1X-6-SUPPLICANT_AUTHENTICATED: Supplicant with identity 00:01:02:03:04:05, MAC 0001.0203.0405 and dynamic VLAN None successfully authenticated on port Ethernet1.\\n  \\nswitch#show ip access-lists\\nPhone ACL bypass: disabled\\nIP Access List 802.1x-3212953518000 [dynamic]\\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 10 deny ip 10.1.0.0/16 20.1.0.0/16\\n     \u0026nbsp; \u0026nbsp;20 permit ip from 11.0.0.0/8 to 12.0.0.0/8\\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 30 permit tcp any any eq 80\\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 40 permit tcp any any eq 443\\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 50 deny ip host 192.168.1.100\\n  \\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Total rules configured: 5\\n  \\nswitch#show dot1x hosts mac 0001.203.0405 detail | json\\n{\\n\u0026nbsp; \u0026nbsp; \\\"supplicantMac\\\": \\\"00:01:02:03:04:05\\\",\\n\u0026nbsp; \u0026nbsp; \\\"identity\\\": \\\"user3\\\",\\n\u0026nbsp; \u0026nbsp; \\\"interface\\\": \\\"Ethernet3/47\\\",\\n\u0026nbsp; \u0026nbsp; \\\"authMethod\\\": \\\"EAPOL\\\",\\n\u0026nbsp; \u0026nbsp; \\\"authStage\\\": \\\"SUCCESS\\\",\\n\u0026nbsp; \u0026nbsp; \\\"fallback\\\": \\\"NONE\\\",\\n\u0026nbsp; \u0026nbsp; \\\"callingStationId\\\": \\\"00:01:02:03:04:05\\\",\\n\u0026nbsp; \u0026nbsp; \\\"reauthBehavior\\\": \\\"DO-NOT-RE-AUTH\\\",\\n\u0026nbsp; \u0026nbsp; \\\"reauthInterval\\\": 0,\\n\u0026nbsp; \u0026nbsp; \\\"cacheConfTime\\\": 0,\\n\u0026nbsp; \u0026nbsp; \\\"vlanId\\\": \\\"202\\\",\\n\u0026nbsp; \u0026nbsp; \\\"accountingSessionId\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"captivePortal\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"captivePortalSource\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"aristaWebAuth\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"supplicantClass\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"filterId\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"framedIpAddress\\\": \\\"0.0.0.0\\\",\\n\u0026nbsp; \u0026nbsp; \\\"framedIpAddrSource\\\": \\\"sourceNone\\\",\\n\u0026nbsp; \u0026nbsp; \u003cspan style=\\\"background-color: rgb(255, 255, 0);\\\"\u003e\\\"nasFilterRules\\\": [\\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \\\"deny in ip from 10.1.0.0/16 to 20.1.0.0/16\\\",\\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \\\"permit in ip from 11.0.0.0/8 to 12.0.0.0/8\\\",\\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \\\"permit tcp any any eq 80\\\",\\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \\\"permit tcp any any eq 443\\\",\\n\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \\u201cdeny ip host 192.168.1.100\\\"\\n\u0026nbsp; \u0026nbsp; ],\u003c/span\u003e\\n\u0026nbsp; \u0026nbsp; \\\"sessionTimeout\\\": 0,\\n\u0026nbsp; \u0026nbsp; \\\"terminationAction\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"tunnelPrivateGroupId\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"aristaPeriodicIdentity\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"cachedAuthAtLinkDown\\\": false,\\n\u0026nbsp; \u0026nbsp; \\\"reauthTimeoutSeen\\\": false,\\n\u0026nbsp; \u0026nbsp; \\\"sessionCached\\\": false,\\n\u0026nbsp; \u0026nbsp; \\\"detail_\\\": true\\n}\u003c/pre\u003e\u003cp\u003eIn the above example the supplicant has been re-authenticated and the nasFilterRules shows 5 rules, as before.\u003c/p\u003e\u003cbr\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restart. \\n\\nNote: supplicants with pending captive-portal authentication during ASU would be impacted with this bug.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eOn affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restart. \u003c/p\u003e\u003cp\u003eNote: supplicants with pending captive-portal authentication during ASU would be impacted with this bug.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1284\", \"description\": \"CWE-1284 Improper Validation of Specified Quantity in Input\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"In order to be vulnerable to CVE-2024-8000, the following three conditions must be met:\\n\\n  *  802.1X must be configured.\\u00a0\\n\\n\\n  *  The customer must have an external AAA server configured which sends a multi-line dynamic ACL.\\u00a0\\n\\n\\n  *  ASU must have occurred ( more information about the upgrade process can be found here at  Upgrades and Downgrades - Arista https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades \\u00a0). The version being upgraded from is an affected software version, and the version being upgraded to is an affected software version as listed above. \\nThe below example shows an example of this issue before and after ASU:\\n\\nswitch#show dot1x hosts mac 0001.0203.0405 detail | json\\n{\\n\\u00a0 \\u00a0 \\\"supplicantMac\\\": \\\"00:01:02:03:04:05\\\",\\n\\u00a0 \\u00a0 \\\"identity\\\": \\\"user3\\\",\\n\\u00a0 \\u00a0 \\\"interface\\\": \\\"Ethernet3/47\\\",\\n\\u00a0 \\u00a0 \\\"authMethod\\\": \\\"EAPOL\\\",\\n\\u00a0 \\u00a0 \\\"authStage\\\": \\\"SUCCESS\\\",\\n\\u00a0 \\u00a0 \\\"fallback\\\": \\\"NONE\\\",\\n\\u00a0 \\u00a0 \\\"callingStationId\\\": \\\"00-01-02-03-04-05\\\",\\n\\u00a0 \\u00a0 \\\"reauthBehavior\\\": \\\"DO-NOT-RE-AUTH\\\",\\n\\u00a0 \\u00a0 \\\"reauthInterval\\\": 0,\\n\\u00a0 \\u00a0 \\\"cacheConfTime\\\": 0,\\n\\u00a0 \\u00a0 \\\"vlanId\\\": \\\"202\\\",\\n\\u00a0 \\u00a0 \\\"accountingSessionId\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"captivePortal\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"captivePortalSource\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"aristaWebAuth\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"supplicantClass\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"filterId\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"framedIpAddress\\\": \\\"0.0.0.0\\\",\\n\\u00a0 \\u00a0 \\\"framedIpAddrSource\\\": \\\"sourceNone\\\",\\n    \\\"nasFilterRules\\\":  [\\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 \\\"deny in ip from 10.1.0.0/16 to 20.1.0.0/16\\\",\\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 \\\"permit in ip from 11.0.0.0/8 to 12.0.0.0/8\\\",\\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 \\\"permit tcp any any eq 80\\\", \\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 \\\"permit tcp any any eq 443\\\",\\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 \\u201cdeny ip host 192.168.1.100\\\"\\n    ],\\n\\u00a0 \\u00a0 \\\"sessionTimeout\\\": 0,\\n\\u00a0 \\u00a0 \\\"terminationAction\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"tunnelPrivateGroupId\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"aristaPeriodicIdentity\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"cachedAuthAtLinkDown\\\": false,\\n\\u00a0 \\u00a0 \\\"reauthTimeoutSeen\\\": false,\\n\\u00a0 \\u00a0 \\\"sessionCached\\\": false,\\n\\u00a0 \\u00a0 \\\"detail_\\\": true\\n}\\n\\n\\n\\u00a0\\n\\nThe above example is before ASU. Note that the \\u201cnasFilterRules\\u201d has 5 rules in it.\\n\\nWhen ASU is performed:\\n\\nswitch#show dot1x hosts mac 0001.0203.0405 detail | json\\n{\\n\\u00a0 \\u00a0 \\\"supplicantMac\\\": \\\"00:01:02:03:04:05\\\",\\n\\u00a0 \\u00a0 \\\"identity\\\": \\\"user3\\\",\\n\\u00a0 \\u00a0 \\\"interface\\\": \\\"Ethernet3/47\\\",\\n\\u00a0 \\u00a0 \\\"authMethod\\\": \\\"EAPOL\\\",\\n\\u00a0 \\u00a0 \\\"authStage\\\": \\\"SUCCESS\\\",\\n\\u00a0 \\u00a0 \\\"fallback\\\": \\\"NONE\\\",\\n\\u00a0 \\u00a0 \\\"callingStationId\\\": \\\"00-01-02-03-04-05\\\",\\n\\u00a0 \\u00a0 \\\"reauthBehavior\\\": \\\"DO-NOT-RE-AUTH\\\",\\n\\u00a0 \\u00a0 \\\"reauthInterval\\\": 0,\\n\\u00a0 \\u00a0 \\\"cacheConfTime\\\": 0,\\n\\u00a0 \\u00a0 \\\"vlanId\\\": \\\"202\\\",\\n\\u00a0 \\u00a0 \\\"accountingSessionId\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"captivePortal\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"captivePortalSource\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"aristaWebAuth\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"supplicantClass\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"filterId\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"framedIpAddress\\\": \\\"0.0.0.0\\\",\\n\\u00a0 \\u00a0 \\\"framedIpAddrSource\\\": \\\"sourceNone\\\",\\n     \\\"nasFilterRules\\\": [\\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 \\\"deny in ip from 10.1.0.0/16 to 20.1.0.0/16\\\"\\n    ],\\n\\u00a0 \\u00a0 \\\"sessionTimeout\\\": 0,\\n\\u00a0 \\u00a0 \\\"terminationAction\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"tunnelPrivateGroupId\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"aristaPeriodicIdentity\\\": \\\"\\\",\\n\\u00a0 \\u00a0 \\\"cachedAuthAtLinkDown\\\": false,\\n\\u00a0 \\u00a0 \\\"reauthTimeoutSeen\\\": false,\\n\\u00a0 \\u00a0 \\\"sessionCached\\\": false,\\n\\u00a0 \\u00a0 \\\"detail_\\\": true\\n}\\n\\n\\nThe above example is after ASU. Note the nasFilterRule is now only one line. \\n\\nNote: This symptom is not present when a non-ASU upgrade (i.e. standard reboot) takes place.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIn order to be vulnerable to CVE-2024-8000, the following three conditions must be met:\u003c/p\u003e\u003col\u003e\u003cli\u003e802.1X must be configured.\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003c/li\u003e\u003cli\u003eThe customer must have an external AAA server configured which sends a multi-line dynamic ACL.\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003c/li\u003e\u003cli\u003eASU must have occurred ( more information about the upgrade process can be found here at \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\\\"\u003eUpgrades and Downgrades - Arista\u003c/a\u003e\u0026nbsp;). The version being upgraded from is an affected software version, and the version being upgraded to is an affected software version as listed above. \u003c/li\u003e\u003c/ol\u003e\u003cp\u003eThe below example shows an example of this issue before and after ASU:\u003c/p\u003e\u003cpre\u003eswitch#show dot1x hosts mac 0001.0203.0405 detail | json\\n{\\n\u0026nbsp; \u0026nbsp; \\\"supplicantMac\\\": \\\"00:01:02:03:04:05\\\",\\n\u0026nbsp; \u0026nbsp; \\\"identity\\\": \\\"user3\\\",\\n\u0026nbsp; \u0026nbsp; \\\"interface\\\": \\\"Ethernet3/47\\\",\\n\u0026nbsp; \u0026nbsp; \\\"authMethod\\\": \\\"EAPOL\\\",\\n\u0026nbsp; \u0026nbsp; \\\"authStage\\\": \\\"SUCCESS\\\",\\n\u0026nbsp; \u0026nbsp; \\\"fallback\\\": \\\"NONE\\\",\\n\u0026nbsp; \u0026nbsp; \\\"callingStationId\\\": \\\"00-01-02-03-04-05\\\",\\n\u0026nbsp; \u0026nbsp; \\\"reauthBehavior\\\": \\\"DO-NOT-RE-AUTH\\\",\\n\u0026nbsp; \u0026nbsp; \\\"reauthInterval\\\": 0,\\n\u0026nbsp; \u0026nbsp; \\\"cacheConfTime\\\": 0,\\n\u0026nbsp; \u0026nbsp; \\\"vlanId\\\": \\\"202\\\",\\n\u0026nbsp; \u0026nbsp; \\\"accountingSessionId\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"captivePortal\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"captivePortalSource\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"aristaWebAuth\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"supplicantClass\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"filterId\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"framedIpAddress\\\": \\\"0.0.0.0\\\",\\n\u0026nbsp; \u0026nbsp; \\\"framedIpAddrSource\\\": \\\"sourceNone\\\",\\n    \u003cspan style=\\\"background-color: rgb(255, 255, 0);\\\"\u003e\u003cb\u003e\\\"nasFilterRules\\\":  [\u003c/b\u003e\\n\u003cb\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \\\"deny in ip from 10.1.0.0/16 to 20.1.0.0/16\\\",\u003c/b\u003e\\n\u003cb\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \\\"permit in ip from 11.0.0.0/8 to 12.0.0.0/8\\\",\u003c/b\u003e\\n\u003cb\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \\\"permit tcp any any eq 80\\\", \u003c/b\u003e\\n\u003cb\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \\\"permit tcp any any eq 443\\\",\u003c/b\u003e\\n\u003cb\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \\u201cdeny ip host 192.168.1.100\\\"\u003c/b\u003e\\n    \u003cb\u003e],\u003c/b\u003e\u003c/span\u003e\\n\u0026nbsp; \u0026nbsp; \\\"sessionTimeout\\\": 0,\\n\u0026nbsp; \u0026nbsp; \\\"terminationAction\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"tunnelPrivateGroupId\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"aristaPeriodicIdentity\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"cachedAuthAtLinkDown\\\": false,\\n\u0026nbsp; \u0026nbsp; \\\"reauthTimeoutSeen\\\": false,\\n\u0026nbsp; \u0026nbsp; \\\"sessionCached\\\": false,\\n\u0026nbsp; \u0026nbsp; \\\"detail_\\\": true\\n}\\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eThe above example is before ASU. Note that the \\u201cnasFilterRules\\u201d has 5 rules in it.\u003c/p\u003e\u003cp\u003eWhen ASU is performed:\u003c/p\u003e\u003cpre\u003eswitch#show dot1x hosts mac 0001.0203.0405 detail | json\\n{\\n\u0026nbsp; \u0026nbsp; \\\"supplicantMac\\\": \\\"00:01:02:03:04:05\\\",\\n\u0026nbsp; \u0026nbsp; \\\"identity\\\": \\\"user3\\\",\\n\u0026nbsp; \u0026nbsp; \\\"interface\\\": \\\"Ethernet3/47\\\",\\n\u0026nbsp; \u0026nbsp; \\\"authMethod\\\": \\\"EAPOL\\\",\\n\u0026nbsp; \u0026nbsp; \\\"authStage\\\": \\\"SUCCESS\\\",\\n\u0026nbsp; \u0026nbsp; \\\"fallback\\\": \\\"NONE\\\",\\n\u0026nbsp; \u0026nbsp; \\\"callingStationId\\\": \\\"00-01-02-03-04-05\\\",\\n\u0026nbsp; \u0026nbsp; \\\"reauthBehavior\\\": \\\"DO-NOT-RE-AUTH\\\",\\n\u0026nbsp; \u0026nbsp; \\\"reauthInterval\\\": 0,\\n\u0026nbsp; \u0026nbsp; \\\"cacheConfTime\\\": 0,\\n\u0026nbsp; \u0026nbsp; \\\"vlanId\\\": \\\"202\\\",\\n\u0026nbsp; \u0026nbsp; \\\"accountingSessionId\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"captivePortal\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"captivePortalSource\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"aristaWebAuth\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"supplicantClass\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"filterId\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"framedIpAddress\\\": \\\"0.0.0.0\\\",\\n\u0026nbsp; \u0026nbsp; \\\"framedIpAddrSource\\\": \\\"sourceNone\\\",\\n     \u003cspan style=\\\"background-color: rgb(255, 255, 0);\\\"\u003e\u003cb\u003e\\\"nasFilterRules\\\": [\u003c/b\u003e\\n\u003cb\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \\\"deny in ip from 10.1.0.0/16 to 20.1.0.0/16\\\"\u003c/b\u003e\\n    \u003cb\u003e],\u003c/b\u003e\u003c/span\u003e\\n\u0026nbsp; \u0026nbsp; \\\"sessionTimeout\\\": 0,\\n\u0026nbsp; \u0026nbsp; \\\"terminationAction\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"tunnelPrivateGroupId\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"aristaPeriodicIdentity\\\": \\\"\\\",\\n\u0026nbsp; \u0026nbsp; \\\"cachedAuthAtLinkDown\\\": false,\\n\u0026nbsp; \u0026nbsp; \\\"reauthTimeoutSeen\\\": false,\\n\u0026nbsp; \u0026nbsp; \\\"sessionCached\\\": false,\\n\u0026nbsp; \u0026nbsp; \\\"detail_\\\": true\\n}\\n\u003c/pre\u003e\u003cp\u003eThe above example is after ASU. Note the nasFilterRule is now only one line. \u003c/p\u003e\u003cp\u003eNote: This symptom is not present when a non-ASU upgrade (i.e. standard reboot) takes place.\u003c/p\u003e\u003cbr\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"shortName\": \"Arista\", \"dateUpdated\": \"2025-03-04T20:20:53.517Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-8000\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-04T20:33:37.805Z\", \"dateReserved\": \"2024-08-19T23:25:41.372Z\", \"assignerOrgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"datePublished\": \"2025-03-04T20:20:53.517Z\", \"assignerShortName\": \"Arista\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.