CVE-2023-24511

On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process.

State: Published
Severity: 5.3 Medium
Published: Apr 12, 2023
Updated: Feb 7, 2025
Reserved: Jan 24, 2023

Read the record on cve.org

Description

On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process. This may result in the snmpd processing being terminated (causing SNMP requests to time out until snmpd is automatically restarted) and potential memory resource exhaustion for other processes on the switch. The vulnerability does not have any confidentiality or integrity impacts to the system.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	Arista

Weaknesses

CWE-401 Improper Release of Memory Before Removing Last Reference

Affected Products

Product	Versions
EOSArista Networks	4.28.0 4.28.5.1MAffected 4.27.0 4.27.8.1MAffected 4.26.0 4.26.9MAffected 4.25.0 4.25.10MAffected 4.24.0 4.24.11MAffected 4.29.0 through 4.29.1FAffected

References

https://www.arista.com/en/support/advisories-notices/security-advisory/17239-security-advisory-0084

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.