In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.
In order to be vulnerable to CVE-2024-6858, the following conditions must be met:
(1) dot1x should be configured on port as authenticator and port-control is auto mode and hostMode is multi-host. Please note the default host-mode is multi-host.
switch(config-if-et1)#show active
interface Ethernet1
…………
dot1x pae authenticator
dot1x port-control auto
dot1x host-mode multi-host
…………
AND
(2) Fallback VLAN should be configured on port. Fallback VLAN can be configured in any of the following ways listed below;
(2-a) Global Configuration for unresponsive VLAN.
switch(config-dot1x)#show active
dot1x
…………
aaa unresponsive action traffic allow vlan <vlan-id>
…………
OR
switch(config-dot1x)#show active
dot1x
…………
aaa unresponsive action traffic allow
…………
OR
(2-b) Global Configuration for unresponsive phone VLAN.
switch(config-dot1x)#show active
dot1x
…………
aaa unresponsive phone action traffic allow
…………
OR
(2-c) Global Configuration for guest VLAN.
switch(config-dot1x)#show active
dot1x
…………
eapol unresponsive action traffic allow vlan <vlan-id>
…………
OR
(2-d) Authentication failure VLAN configured on port.
switch(config-if-et1)#show active
interface Ethernet1
…………
dot1x authentication failure action traffic allow vlan <vlan_id>
…………
OR
(2-e) Unresponsive VLAN configured on port.
switch(config-if-et1)#show active
interface Ethernet1
…………
dot1x aaa unresponsive action traffic allow vlan <vlan_id>
…………
OR
(2-f) Unresponsive phone VLAN configured on port.
switch(config-if-et1)#show active
interface Ethernet1
…………
dot1x aaa unresponsive phone action traffic allow
…………
This vulnerability arises when there is an EAPOL supplicant in any of the fallback VLAN’s ( i.e. auth-fail, unresponsive VLAN ). If only unauthenticated EAPOL supplicants are expected the admin can change dot1x host-mode to single-host as indicated below.
switch(config-if-et1)#dot1x host-mode single-host
Single Host Mode: Please note when once the 802.1X supplicant is authenticated on the port, ONLY the traffic coming from the supplicant's MAC is allowed through the port.
Multi-Host Mode: Once the 802.1X supplicant is authenticated on the port, traffic coming from ANY source MAC is allowed through the port.
Multi-Host authenticated Mode: Multiple 802.1X supplicants can be allowed and ONLY the traffic coming from all authenticated supplicant’s MAC is allowed through the port.
The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades
CVE-2024-6858 has been fixed in the following releases:
- 4.31.2F and later releases in the 4.31.x train.
- 4.30.6M and later releases in the 4.30.x train.
- 4.29.8M and later releases in the 4.29.x train.
- 4.28.11M and later releases in the 4.28.x train.