CVE-2020-3569
Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
Description
CVE-2020-3569 is a HIGH severity denial-of-service vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software, classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). This vulnerability is closely related to CVE-2020-3566 and stems from the incorrect handling of IGMP packets, allowing an unauthenticated, remote attacker to either immediately crash the IGMP process or cause progressive memory exhaustion leading to instability across routing processes. With a CVSS 3.1 score of 8.6 and an EPSS score of 0.05554 (90.16th percentile), this vulnerability poses a significant threat to network availability. CISA added it to the KEV catalog on November 3, 2021.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | ios xr | 6.1.4; 6.2.3; 6.3.3; 6.4.2; 6.5.3; 6.6.2; 6.6.3; 7.0.2; 7.1.2; 7.1.15; < 6.5.2; 6.4.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3569(US Government Resource)
Weakness Type
CWE-770: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling occurs when software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated. When resource allocation is unbounded, an attacker can cause the software to consume excessive amounts of a resource, leading to denial of service for legitimate users. This weakness is particularly dangerous in network services that process incoming traffic, as attackers can generate high volumes of requests to trigger unchecked resource allocation.
In the context of CVE-2020-3569, the DVMRP feature in Cisco IOS XR Software allocates memory for incoming IGMP packets without enforcing limits on the total number of queued packets or the aggregate memory consumed by the IGMP process. Multiple related vulnerabilities exist in the IGMP packet handling code, allowing an attacker to either trigger an immediate process crash through malformed packets or cause gradual memory exhaustion through a sustained volume of crafted IGMP traffic. The lack of resource throttling means the IGMP process will continue allocating memory until the system's available memory is depleted, destabilizing all co-resident routing processes.
Learn more: CWE-770 — Allocation of Resources Without Limits or Throttling
Impact Analysis
CVE-2020-3569 carries a CVSS 3.1 base score of 8.6 (HIGH) with network-exploitable attack characteristics and a Changed scope.
Confidentiality (None): This vulnerability does not enable data exfiltration or unauthorized access to confidential information. The attack vector is focused entirely on service disruption.
Integrity (None): The vulnerability does not provide mechanisms for modifying device configurations, routing tables, or data in transit. Its impact is constrained to resource consumption.
Availability (High): The availability impact is severe and multifaceted. An attacker can either immediately crash the IGMP process by sending specially crafted packets, or gradually exhaust device memory through sustained IGMP traffic. Both attack modes disrupt multicast services and, through memory pressure, destabilize critical unicast routing processes including BGP, OSPF, and IS-IS. Loss of routing adjacencies triggers network-wide convergence events affecting all services dependent on the compromised router.
Scope (Changed): The Changed scope reflects the cascading nature of the memory exhaustion. The vulnerability in the IGMP/DVMRP subsystem impacts the broader device ecosystem, affecting routing processes and network services that operate independently of multicast functionality. A single exploited router can cause routing disruptions that propagate across the service provider or enterprise backbone, impacting connectivity for networks multiple hops away from the target device.
Exploit Maturity
Active Exploitation: CVE-2020-3569 is actively exploited in the wild. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on November 3, 2021, with a mandatory remediation deadline of May 3, 2022 for federal agencies. The vulnerability shares the same attack surface as CVE-2020-3566 and was disclosed alongside it.
Companion Vulnerability: CVE-2020-3569 was disclosed on September 23, 2020 as part of the same advisory as CVE-2020-3566. Both vulnerabilities affect the DVMRP IGMP processing code in IOS XR and are addressed by the same software updates. The existence of multiple vulnerabilities in the same code path suggests that the IGMP handling subsystem had systemic weaknesses.
Dual Attack Modes: Unlike CVE-2020-3566 which focuses on memory exhaustion, CVE-2020-3569 additionally allows an attacker to immediately crash the IGMP process through specific malformed packets, providing a faster path to service disruption.
EPSS Context: The EPSS score of 0.05554 (90.16th percentile) indicates a high probability of exploitation, placing this vulnerability in the top 10% of all CVEs for exploitation likelihood.
Affected Versions: A wide range of IOS XR versions are affected, including 5.x, 6.1.4, 6.2.3, 6.3.3, 6.4.2, 6.4.3, 6.5.x, 6.6.x, 7.0.2, 7.1.2, and 7.1.15.
Remediation
-
Apply Cisco IOS XR software updates. Install the patched versions as described in Cisco Security Advisory cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz. This advisory covers both CVE-2020-3569 and its companion vulnerability CVE-2020-3566.
-
Implement IGMP traffic filtering immediately. Deploy access control lists on all interfaces to filter IGMP traffic from untrusted or unauthorized sources. This serves as an effective interim mitigation while software updates are being tested and deployed.
-
Disable multicast routing where not required. On interfaces and VRFs that do not need multicast functionality, disable DVMRP and IGMP processing entirely to eliminate the attack surface.
-
Configure IGMP rate limiting. Apply IGMP rate limits on interfaces facing untrusted networks to prevent the sustained traffic volumes required for memory exhaustion attacks. Rate limiting also mitigates the immediate crash vector.
-
Enable process restart monitoring. Configure process restart tracking on IOS XR devices to detect and alert on unexpected IGMP process crashes, which may indicate active exploitation attempts.
-
Plan for coordinated patching with CVE-2020-3566. Since both vulnerabilities are addressed by the same software update, plan the maintenance window to remediate both issues simultaneously across all affected IOS XR devices in the network.
Technical Details
CVE-2020-3569 encompasses multiple vulnerabilities in the DVMRP feature of Cisco IOS XR Software related to incorrect handling of IGMP packets. The vulnerabilities exist in the same IGMP processing code path that is affected by CVE-2020-3566, but CVE-2020-3569 includes additional attack vectors that can cause an immediate process crash in addition to the gradual memory exhaustion.
The IGMP process in IOS XR handles multicast group membership queries and reports. The vulnerable code fails to properly validate the structure and content of incoming IGMP packets before allocating resources. Two distinct attack modes exist: first, certain malformed IGMP packets trigger an unhandled exception or null pointer dereference that immediately crashes the IGMP process; second, a sustained volume of crafted but structurally valid IGMP packets causes unbounded memory allocation that gradually exhausts available system memory.
The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) is identical to CVE-2020-3566, reflecting the same network-based attack with low complexity, no authentication requirement, and Changed scope. The Changed scope is significant because the IGMP process crash or memory exhaustion cascades to affect BGP, OSPF, IS-IS, and other routing protocol processes sharing the same memory space.
The broad range of affected versions — spanning IOS XR 5.x through 7.1.x — indicates that the vulnerable code has been present in the IGMP processing subsystem for many years. The advisory from Cisco covers versions including 6.1.4, 6.2.3, 6.3.3, 6.4.2, 6.4.3, 6.5.3, 6.6.2, 6.6.3, 7.0.2, 7.1.2, and 7.1.15, suggesting widespread exposure across deployed IOS XR infrastructure.
Frequently Asked Questions
Is CVE-2020-3569 being actively exploited?
Yes, CVE-2020-3569 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021. It was disclosed alongside CVE-2020-3566 as part of the same advisory covering multiple DVMRP/IGMP vulnerabilities in Cisco IOS XR. Both vulnerabilities share the same attack surface and exploitation techniques.
What products are affected by CVE-2020-3569?
CVE-2020-3569 affects Cisco devices running IOS XR Software with DVMRP multicast routing enabled. Affected versions span a wide range including IOS XR 5.x, 6.1.4, 6.2.3, 6.3.3, 6.4.2, 6.4.3, 6.5.3, 6.6.2, 6.6.3, 7.0.2, 7.1.2, and 7.1.15. These versions are deployed on Cisco service provider routers including the ASR 9000 and NCS 5500 series.
How do I fix CVE-2020-3569?
Apply the Cisco IOS XR software update from security advisory cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz, which addresses both CVE-2020-3569 and CVE-2020-3566. As interim mitigations, implement IGMP traffic filtering via access control lists, configure rate limiting for IGMP packets, and disable multicast routing on interfaces where it is not needed.
How severe is CVE-2020-3569?
CVE-2020-3569 is rated HIGH with a CVSS score of 8.6 and a Changed scope. It provides two attack modes: an immediate IGMP process crash and a gradual memory exhaustion that destabilizes all routing processes on the device. In service provider environments, exploitation of a single IOS XR router can cause cascading routing disruptions affecting many downstream networks and customers.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.