CVE-2020-3569

What is DVMRP on Cisco IOS XR?

Distance Vector Multicast Routing Protocol (DVMRP) is used by carrier-grade routers running Cisco IOS XR to route multicast traffic across service provider networks. This CVE and its closely related twin, CVE-2020-3566 (also enriched on this site), describe the same underlying flaw and were disclosed together.

Overview

CVE-2020-3569 is a denial-of-service vulnerability (CWE-400, uncontrolled resource consumption) in how IOS XR's DVMRP implementation handles crafted Internet Group Management Protocol (IGMP) packets. An unauthenticated remote attacker can send specially crafted IGMP traffic that causes the device's IGMP process to immediately crash or, alternatively, to progressively consume all available memory until it eventually crashes (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, 8.6 High). What made this disclosure unusual is that Cisco published mitigation guidance and confirmed active exploitation before it had a permanent software fix ready — an emergency advisory rather than the standard "patch is available, please apply it" release.

Technical Details

The vulnerability stems from insufficient validation of IGMP packet fields used in DVMRP multicast route processing; a crafted packet can trigger unbounded memory allocation tied to processing that packet, and repeated crafted packets exhaust available device memory faster than normal operation would ever require, leading to a crash and denial of service on carrier-grade routing infrastructure.

Discovery

Identified and reported by Cisco's own Talos threat intelligence team, which published technical detail on the vulnerability alongside Cisco's security advisory.

Exploitation Context

Cisco confirmed observing exploitation attempts against internet-facing IOS XR devices around the time of its August 2020 advisory, which is why the company issued mitigation guidance immediately rather than waiting for a full software fix — an atypical but appropriate response to active 0-day exploitation of carrier infrastructure, where DoS attacks against core routing equipment can have outsized real-world impact.

Remediation

1. Apply Cisco's software fix for IOS XR once available for your platform, and in the interim, implement the mitigation guidance in Cisco's advisory (rate-limiting DVMRP/IGMP traffic).
2. Restrict DVMRP/multicast traffic acceptance to only trusted, expected peer routers rather than accepting it broadly.
3. Monitor device memory utilization on IOS XR routers running DVMRP for anomalous growth patterns that could indicate active exploitation attempts.
4. Treat this and CVE-2020-3566 as a single remediation item — they describe the same underlying flaw and should be patched and mitigated together.