Cisco NX-OS Software: Out-of-bounds Read
CVE-2022-20823 is a high-severity out-of-bounds read vulnerability in Cisco NX-OS Software from Cisco, with a CVSS 3.1 base score of 8.6 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. There is no confirmed exploitation so far. EPSS estimates a 1.16% chance of exploitation within 30 days, higher than 68% of scored CVEs.
High severity with no evidence of exploitation so far.
What to do
- Check which version of Cisco NX-OS Software you run against the affected versions below, and install the vendor's latest release.
- Read the advisory on tools.cisco.com for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Cisco | Cisco NX-OS Software | Not specified in the record | Not stated |
| Cisco | Nexus 3016 Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3016q Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3048 Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3064 Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3064-32t Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3064-t Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3064-x Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3064t Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3064x Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3100 Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3100-v Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3100-z Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3100v Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 31108pc-v Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 31108pv-v Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 31108tc-v Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 31128pq Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3132c-z Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3132q Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3132q-v Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3132q-x Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3132q-x/3132q-xl Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3132q-xl Firmware | Not specified in the record | Not stated |
| Cisco | Nexus 3164q Firmware | Not specified in the record | Not stated |
Version data comes from the organisation that assigned the CVE; 35 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 8.6 | High | CNA (cisco.com) |
| CVSS 3.1 | 8.6 | High | NVD |
Official description
A vulnerability in the OSPF version 3 (OSPFv3) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to incomplete input validation of specific OSPFv3 packets. An attacker could exploit this vulnerability by sending a malicious OSPFv3 link-state advertisement (LSA) to an affected device. A successful exploit could allow the attacker to cause the OSPFv3 process to crash and restart multiple times, causing the affected device to reload and resulting in a DoS condition. Note: The OSPFv3 feature is disabled by default. To exploit this vulnerability, an attacker must be able to establish a full OSPFv3 neighbor state with an affected device. For more information about exploitation conditions, see the Details section of this advisory.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How developers prevent this class of flaw
- Use a language that provides appropriate memory abstractions.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Advisories
Other vulnerabilities in Cisco NX-OS Software
- 9.8 Critical severity
- 9.8 Critical severity
- 9.8 Critical severity
- 9.8 Critical severity
- 9.8 Critical severity
- 9.8 Critical severity
Recent Out-of-bounds Read vulnerabilities
- 8.1 High severity
- 7.8 High severity
- 7.5 High severity
- 7.8 High severity
- 7.8 High severity
- 7.5 High severity
Spotted an error? Tell us.