The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades   CVE-2024-5872 has been fixed in the following releases: * 4.33.0F and later releases in the 4.33.x train * 4.32.3M and later releases in the 4.32.x train * 4.31.5M and later releases in the 4.31.x train * 4.30.8M and later releases in the 4.30.x train * 4.29.9M and later releases in the 4.29.x train * 4.28.12M and later releases in the 4.28.x train

There are multiple conditions which must be met. An L3 interface must be configured on the device and at least one of four additional conditions, detailed below and labeled 1 through 4, must be met. In addition to the configuration the packet being sent must have an incorrect VLAN tag. In order to be vulnerable to CVE-2024-5872, an L3 interface MUST be configured on the device. To check IPv4 L3 interface configuration: Switch>show ip interface brief                                                               Address Interface     IP Address         Status   Protocol     MTU   Owner ------------- ------------------ --------- ---------- ------ ------- Ethernet5/1   5.1.1.1/24         up       up         1500 Management1   10.240.112.30/25   up       up         1500 Vlan4         4.1.1.1/24         up       up         1500   To check IPv6 L3 interface configuration: Switch>show ipv6 interface brief Interface Status MTU IPv6 Address           Addr State Addr Source --------- ------- ---- ----------------------- ---------- ----------- Ma1       up     1500 fe80::d3ff:fe5f:73e9/64 up         link local                        fdfd:5c41:712d::701e/64 up         config Vl4       up     1500 fe80::d3ff:fe5f:73ea/64 up         link local                        120::1/120             up         config   AND At least one of the following conditions (#’s 1-4 below) must be met: * Either IPv4 routing or IPv6 routing is not configured, which will cause the vulnerability to impact IPv4 unicast packets or IPv6 unicast packets, respectively: Switch>show ip IP Routing : Disabled IP Multicast Routing : Disabled IPv6 Multicast Routing : Disabled IPv6 Interfaces Forwarding : None IPv6 Unicast Routing : Disabled OR * For packets with TTL of 0 or 1, all IP configurations are vulnerable.   OR * Unicast and multicast routing must be configured for IPv4 to be vulnerable for IPv4 multicast packets, and IPv4 multicast must be enabled on an L3 interface: Switch>show ip IP Routing : Enabled IP Multicast Routing : Enabled IPv6 Multicast Routing : Disabled IPv6 Interfaces Forwarding : None IPv6 Unicast Routing : Disabled Switch(config-if-Vl4)#show active interface Vlan4    ip address 4.1.1.1/24    pim ipv4 sparse-mode OR * Unicast and multicast routing must be configured for IPv6 to be vulnerable to IPv6 multicast packets, and IPv6 multicast must be enabled on an L3 interface: Switch>show ip IP Routing : Disabled IP Multicast Routing : Disabled IPv6 Multicast Routing : Enabled IPv6 Interfaces Forwarding : None IPv6 Unicast Routing : Enabled Switch(config-if-Vl4)#show active interface Vlan4    ipv6 address 120::1/120    pim ipv6 sparse-mode

There is no workaround.