CVE-2017-12238

CVE-2017-12238 is a memory management flaw (CWE-399) in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 on Cisco Catalyst 6800 Series Switches. An unauthenticated, adjacent attacker can trigger it by creating a large number of VPLS-generated MAC entries in the device's MAC address table, causing memory mismanagement that crashes a C6800-16P10G or C6800-16P10G-XL line card. The impact is a denial of service: traffic handled by the crashed line card is interrupted, with no confidentiality or integrity impact (CVSS 3.1 base 6.5, availability-focused). Only deployments running Cisco IOS 15.0-15.4 on a Catalyst 6800 with Supervisor Engine 6T, a C6800-16P10G or C6800-16P10G-XL line card, VPLS configured, and that line card serving as the core-facing MPLS interface are affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03), indicating known in-the-wild exploitation, though no public proof-of-concept is known and ransomware use is unconfirmed.

What to do: Inventory Catalyst 6800 chassis for C6800-16P10G or C6800-16P10G-XL line cards on Supervisor Engine 6T with VPLS configured and the line card as the core-facing MPLS interface, and upgrade Cisco IOS to a fixed release per Cisco's advisory (Bug ID CSCva61927), since all 15.0-15.4 trains listed are vulnerable. Because the flaw is on CISA's KEV list, prioritize patching; interim mitigations include restricting adjacent access to the MPLS core-facing interfaces and monitoring for abnormal MAC address table growth on VPLS instances.