CVE-2023-24512

On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch.

While the steps listed above resolve the issue, the recommended long term solution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. There are two possible solutions: Upgrade the Streaming Telemetry Agent Customers can upgrade the Streaming Telemetry Agent to a fixed version, following the directions in https://arista.my.site.com/AristaCommunity/s/article/terminattr-upgrade-downgrade. Fixes are available in the following supported release trains: TerminAttr 1.25.0 and later Terminattr versions Users of 1.24.X and 1.23.X TerminAttr releases should upgrade to TerminAttr 1.25.0 or later. TerminAttr 1.22.2 and later version in the TerminAttr 1.22.X train TerminAttr 1.19.6 and later versions in the TerminAttr 1.19.X train

Upgrade EOS Customers can upgrade to a version of EOS which contains a fixed version of the Streaming Telemetry Agent within the EOS image, as documented in https://www.arista.com/en/um-eos/eos-upgradedowngrade-overview: EOS 4.29.2F and later releases, which contains TerminAttr 1.25.0 or a more recent version EOS 4.28.6M and later releases in the 4.28.X train, which contains TerminAttr 1.22.2 or a more recent version EOS 4.27.9M and later releases in the 4.27.X train, which contains TerminAttr 1.19.6 or a more recent version EOS 4.26.10M and later releases in the 4.26.X train, which contains TerminAttr 1.19.6 or a more recent version