CVE-2024-8000 Details

A vulnerability exists in Arista EOS versions 4.32.4M and below in the 4.32.x train, as well as in 4.31.5M and below in the 4.31.x train. On affected platforms with 802.1X configured, a dynamic Access Control List (ACL) received from the AAA server may result in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restart. This issue impacts supplicants with pending captive-portal authentication during ASU, leading to unauthorized traffic flows if the ACL is not correctly programmed post-ASU.

Users can re-authenticate each supplicant by running the 'dot1x re-authenticate' command on the interface after ASU. Alternatively, if the re-authentication timer is enabled, the ACL will be correctly updated once the timer expires and re-authentication occurs. Flapping the interface will also trigger re-authentication and correct the ACL. For a permanent fix, upgrade to Arista EOS versions 4.33.0M and above, or 4.32.5M, 4.31.6M, or 4.30.9M and above, depending on the current version.