CVE-2018-0155

What is Bidirectional Forwarding Detection (BFD)?

BFD is a lightweight protocol used by routers and switches to rapidly detect failures in the forwarding path between two adjacent devices, allowing routing protocols to reconverge in milliseconds rather than waiting for slower hello-timer-based failure detection. On Cisco Catalyst 4500 and 4500-X switches, BFD packet processing can be offloaded to a supervisor engine's hardware/software path to keep detection fast without burdening the main control-plane process.

Overview

CVE-2018-0155 is a high-severity denial-of-service vulnerability in the BFD offload implementation on Cisco Catalyst 4500 and 4500-X series switches. An unauthenticated, remote attacker able to send crafted BFD packets to an affected switch can crash the iosd process — the core IOS operating system process — forcing the device to reload and disrupting all traffic it was forwarding.

Technical Details

The vulnerability is classified under CWE-388 (error handling), reflecting a failure to properly handle malformed or unexpected BFD packet content in the offload path. Because BFD is designed to operate directly between adjacent network devices at high speed, the offload code path processes packets with minimal overhead — and correspondingly minimal validation — making it a soft target for a crafted packet that the switch was not designed to reject cleanly. The CVSS vector's Scope: Changed reflects that impact extends beyond the BFD subsystem itself to crash the broader iosd process.

Discovery

Cisco identified and fixed the issue internally, releasing it as part of the March 2018 semiannual IOS/IOS XE security advisory bundle.

Exploitation Context

CISA's KEV catalog listing confirms this vulnerability has been exploited in real-world attacks. Denial-of-service flaws in core switching infrastructure like the Catalyst 4500 line are valuable to attackers seeking to disrupt campus or data-center network availability, and BFD's use directly between routing peers means an attacker positioned on an adjacent segment (or able to spoof a BFD peer) can trigger repeated outages.

Remediation

1. Identify Catalyst 4500 and 4500-X switches configured with BFD offload and confirm their IOS software version.
2. Apply the Cisco-published fixed software release from the corresponding security advisory.
3. Restrict which neighbors can establish BFD sessions using authentication or interface-level ACLs where supported.
4. Monitor for unexpected iosd crashes or switch reloads correlated with BFD-enabled interfaces.
5. If BFD offload is not operationally required, disable it to remove the exposed code path until patched.