Cumulus Linux 3.7 Release Notes
Download all 3.7 release notes as .xls
3.7.13 Release Notes
Open issues in 3.7.13
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-29759 | When you use nginx and restserver in management VRF to provide a REST API for the switch, nginx starts but restserver fails to start.To work around this issue, comment out the Requires= line in the /lib/systemd/system/restserver.service. For example:#Requires=nginx.service restserver.socket | 3.7.12-3.7.13 | |
| CM-29740 | The exim4 package available for optional installation on Cumulus Linux 3.x has the following vulnerability:DLA-2213-1 / CVE-2020-12783: Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. The spa authentication driver is not enabled by default. Vulnerable: <= 4.84.2-2+deb8u6 Fixed: 4.84.2-2+deb8u7 | 3.0.0-3.7.13 | |
| CM-29667 | After installing Cumulus Linux on the Mellanox SN2100 switch, if you break out a port (for example, if you break out swp1 into four ports: swp1s0, swp1s1, swp1s2, swp1s3) in the /etc/cumulus/ports.conf file, then run the systemctl start switchd command, the update does not take effect.To work around this issue, run the systemctl restart switchd command. | 3.7.12-3.7.13 | |
| CM-29594 | When you run an Ansible script to replace the /etc/network/interfaces file, then run the ifreload -a command, you see errors similar to the following:error: swp1s1.2: netlink: cannot set link swp1s1.2 up: operation failed with ‘Network is down’ (100) To work around this issue, run the ifreload -a command a second time. | 3.7.12-3.7.13 | |
| CM-29562 | If you have an SVI with multiple VRR IP addresses and try to delete one of the VRR configurations, net commit or ifreload -a returns an error. | 3.7.12-3.7.13 | |
| CM-29556 | CVE-2020-11868: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp. This affects: ntp-4.2.8p12 (possibly earlier) and ntp-4.2.8p13 The fix for https://bugs.ntp.org/3445 introduced a bug whereby a system that is running ntp-4.2.8p12 or p13 that only has one unauthenticated time source can be attacked in a way that causes the victim’s next poll to its source to be delayed, for as long as the attack is maintained. http://support.ntp.org/bin/view/Main/NtpBug3592 gives the following mitigations if it is not possible to upgrade to a version with the fix:
| 3.0.0-3.7.13 | |
| CM-29546 | In vtysh, if you configure, then remove a layer 3 VNI for a VRF, the VNI is removed from zebra even if the VNI interface still exists in the kernel. If you configure a layer 2 VNI as a layer 3 VNI by mistake, removing the layer 3 VNI binding removes it from zebra but EVPN-learned MACs and neighbors are not installed into the kernel. To work around this issue, delete, then re-add the missing VNI. For example: cumulus@switch:~$ sudo ifdown vni10100 If you flap the link with the ip link set vni10100 down; ip link set vni10100 up commands, zebra does not re-add the VNI. | 3.7.12-3.7.13 | |
| CM-29525 | The asic-monitor.service fails when you configure /etc/cumulus/datapath/monitor.conf with monitor.histogram_pg.collect.port_group_list = <span class="error">[all_packet_pg]</span> and there is traffic passing through the buffer. When the service fails, you see the following traceback in journalctl:asic-monitor[7389]: asic-monitor-module INFO: 2020-05-01 18:28:12.548734: Egress queue(s) greater than 500 bytes in monitor port group histogram_pg | 3.7.11-3.7.13 | |
| CM-29519 | The JSON format output of the net show bgp l2vpn evpn summary command shows the incorrect neighbour state. | 3.7.12-3.7.13 | |
| CM-29492 | When you create SPAN or ERSPAN rules in ebtables, the action fails to install if it is not in lowercase. Make sure that the SPAN or ERSPAN action is all lowercase; for example:[ebtables] | 3.7.12-3.7.13 | |
| CM-29367 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-3.7.13 | |
| CM-29309 | When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. | 3.7.11-3.7.13 | |
| CM-29259 | You might see the following gport error messages in switchd.log:
These messages are harmless and can be ignored. | 3.7.12-3.7.13 | |
| CM-29165 | An inconsistent link-state advertisement may be seen with FRR/OSPF in some circumstances. For example, when you configure the OSPF default originate route as metric-type 1 with a specific metric, Cumulus Linux shows the default originate route as an external metric-type 2 route with the default metric in the database. This problem has been observed when there are both IPv4 and IPv6 default routes in the routing table. | 3.7.12-3.7.13 | |
| CM-29068 | On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-3.7.13 | |
| CM-29043 | When a multipath route that contains an EVPN path exists together with an IPv4 BGP path in the VRF, the RMAC to VTEP binding is incorrect. This invalid entry occurs because Cumulus Linux treats IPv4 routes received over the eBGP IPv4 peering incorrectly in the VRF. To work around this issue, remove the unnecessary eBGP IPv4 peering. | 3.7.12-3.7.13 | |
| CM-29037 | Silent reboots sometimes occur on the switch with nothing that indicates a reboot reason in the syslog file. | 3.7.12-3.7.13 | |
| CM-28944 | A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted. To work around this issue, reenter the redistribute <connected\|static> route-map <route-map-name> statement in the configuration. | 3.6.2-3.7.13 | |
| CM-28940 | If you configure aggregate-address <address> summary-only before a component of the same aggregate is injected into the BGP table with the network or redistribute command, when you remove the aggregate-address configuration, the component stays suppressed; it is not advertised to peers. For example:Existing configuration: router bgp 1 If you add network 50.0.0.1/32, you see the following (expected) BGP table entries:Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, Removing aggregate-address 50.0.0.0/8 summary-only at this point results in the following (unexpected) BGP table entry:Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, To work around this issue, remove, then re-add the component prefix routes. | 3.7.12-3.7.13 | |
| CM-28938 | When you install an ACL LOG/DROP rule on a layer 3 ingress interface that is a member of a VRF, traffic that matches this rule is not logged and is still forwarded. To work around this issue, apply the ACL LOG/DROP rule to the VRF device itself or to the layer 2 VNI. | 3.7.6-3.7.13 | |
| CM-28816 | The following security advisory has been announced for bash: CVE-2019-18276 Qualys scan QID 372268 setuid vulnerability When bash or bash scripts are run setuid, bash is supposed to drop privileges, but does so incorrectly, so that an attacker with command access to the shell can use enable -f for runtime loading of a new builtin that calls setuid() to regain dropped privileges.To work around this issue, do not make bash or bash scripts setuid. | 3.0.0-3.7.13 | |
| CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.13 | |
| CM-28613 | In EVPN Active-Active (MLAG) environments, rebooting one member of an MLAG pair should result in the local MAC mobility sequence number reverting to 0. Sometimes a reboot of one MLAG peer results in the local MAC mobility sequence number being set to a non-zero value despite that no more mobility events occur. This issue is cosmetic only, as BGP does not advertise the incorrect sequence number and forwarding entries correctly point to the remote VTEP where the MAC is now located. | 3.7.12-3.7.13 | |
| CM-28611 | In an EVPN Active-Active (MLAG) environment, sometimes a local-to-remote MAC mobility event results in the local sequence number appearing higher than the remote sequence number in zebra. This issue is cosmetic only, as BGP does not advertise the incorrect sequence number and forwarding entries correctly point to the remote VTEP where the MAC is now located. | 3.7.12-3.7.13 | |
| CM-28533 | On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-3.7.13 | |
| CM-28488 | The following CVEs were announced that affect the cron package. All of these require untrusted local user access.CVE-2017-9525 is a local user privilege escalation attack: In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs. CVE-2019-9704, CVE-2019-9705, CVE-2019-9706 are local user denial of service attacks. Note: the fix for CVE-2019-9705 imposes a limitation on the length of a crontab file (the vulnerability was that an unlimited size crontab file could cause excessive memory consumption). https://security-tracker.debian.org/tracker/DLA-1723-1 | 3.0.0-3.7.13 | |
| CM-28487 | The following CVE was announced for rsyslog: CVE-2019-17041 CVE-2019-17042 rsyslogd, when receiving remote log messages and using optional pmaixforwardedfrom or pmcisconames parser modules (not enabled by default on Cumulus Linux), is vulnerable to CVE-2019-17041 and CVE-2019-17042 where malicious messages that appear to be from AIX or Cisco respectively may be caused to skip sanity checks, resulting in incorrect negative lengths causing heap overflows.Do not enable (with $UDPServerRun or $InputTCPServerRun) receiving syslog messages from other hosts by the network. Also, do not enable (with $ModLoad) the vulnerable parsers pmaixforwardedfrom or pmcisconames.<br/>The default /etc/rsyslog.conf file on Cumulus Linux does NOT enable $UDPServerRun or $InputTCPServerRun, so the vulnerability is not network exploitable in the default configuration. In addition, the vulnerable parsers are not enabled in the default configuration. | 3.0.0-3.7.13 | |
| CM-28465 | When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. | 3.7.11-3.7.13 | |
| CM-28462 | On rare occasions, when you upgrade Cumulus Linux with the apt-get upgrade command, the upgrade fails and reports No space left on device. Checking the disk utilization shows that the disk is not full.To work around this issue, run the apt-get upgrade command again and reboot the device if prompted to complete the upgrade. | 3.7.10-3.7.13 | |
| CM-28451 | An error similar to the following shows in syslog for Mellanox switches:2020-02-12T19:59:22.208012+08:00 leaf01 sx_sdk: RM_TABLE: No resources available to add 1 entries to KVD hash Table HW resource To work around this issue, reboot the switch. | 3.7.11-3.7.13 | |
| CM-28442 | PTM mis-detects incorrect hostnames of LLDP neighbors and does not fail them as expected. Instead they end up in an N/A cabling status. | 3.7.11-3.7.13 | |
| CM-28441 | If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. | 3.7.11-3.7.13 | |
| CM-28393 | On the Dell S5232F-ON switch, EVPN and dynamic VRF route leaking results in the CPU forwarding traffic to newly-learned type-2 routes. To work around this issue, restart FRR. | 3.7.9-3.7.13 | |
| CM-28376 | On the Dell S5232F-ON switch, the output of ledmgrd shows amber_blinking but smonctl shows all OK. | 3.7.11-3.7.13 | |
| CM-28372 | On the EdgeCore AS7326-56X switch, the default fan speed, which is defined in the thermal specification, results in excessive fan noise. | 3.7.11-3.7.13 | |
| CM-28212 | The hsflowd service sends an undefined header protocol 0 in the sampled flow sample to the collector, which is not recognized by the sFlow tool. You see errors similar to the following:Dec 20 08:43:27 netflow-nms sfcapd[3991]: SFLOW: readFlowSample_header() undefined headerProtocol = 0 | 3.7.11-3.7.13 | |
| CM-28136 | The MLAG switch pair has VLANs defined that are not used on MLAG bonds. These VLANs still synchronize MAC addresses across to the peer switch. This results in log messages that indicate a MAC address is installed and the VLAN is not defined; for example:RTM_NEWNEIGH with unconfigured vlan XXXX on port peerlink | 3.7.10-3.7.13 | |
| CM-28080 | TACACS+ through ClearPass is not currently supported. Cumulus Linux sends authorization before authentication, but ClearPass does not accept an authorization before the user is authenticated. | 3.7.11-3.7.13 | |
| CM-28078 | On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-3.7.13 | |
| CM-28076 | After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom --init command. | 3.6.0-3.7.13 | |
| CM-28061 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-3.7.13 | |
| CM-28003 | The FRR service does not provide a way for automation to know if the configuration applied properly. To work around this issue, execute the vtysh -f <file> command in the automation file before starting the FRR service to validate the functional configuration and return an error code. | 3.7.11-3.7.13 | |
| CM-27999 | On the EdgeCore AS7326-56X switch, the PSU fans show constant LOW warnings. | 3.7.10-3.7.13 | |
| CM-27957 | If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:bq. systemd[1]: switchd.service watchdog timeout (limit 2min)! To workaround this issue, either reduce the number of configured interfaces and/or VLANs or increase the systemd timeout for switchd.service.To increase the systemd timeout:
| 3.7.11-3.7.13 | |
| CM-27937 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 One of the listed vulnerabilities is still present in the latest upstream version 2.1+dfsg-12+deb8u12 (the others have been fixed): CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. https://security-tracker.debian.org/tracker/CVE-2017-15124 | 3.0.0-3.7.13 | |
| CM-27814 | A traditional bridge with QinQ and a VNI does not work for tagged traffic. | 3.7.10-3.7.13 | |
| CM-27793 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.27+dfsg-1 Fixed: 2.1.27+dfsg-1+deb10u1 | 3.0.0-3.7.13 | |
| CM-27698 | SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.13 | |
| CM-27620 | When using QinQ with a traditional bridge, if you enable the LLDP dot1 TLV option, you see the following suboptimal behavior:
| 3.7.11-3.7.13 | |
| CM-27581 | On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel.To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.This workaround only works when an out-of-band network is present. | 3.7.11-3.7.13 | |
| CM-27530 | When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. | 3.7.10-3.7.13 | |
| CM-27522 | The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. | 3.7.10-3.7.13 | |
| CM-27354 | On the Celestica Pebble switch, if you use IPv6 routes with mask /65 to /127, the switchd log fills with errors. | 3.7.10-3.7.13 | |
| CM-27279 | When ECMP routes have both VXLAN (symmetric routing) and non-VXLAN paths, the non-VXLAN path is incorrectly installed in the RIB and FIB to point across VXLAN. The non-VXLAN next-hop will be installed as an offload entry in the neighbor table (ip neigh show) with a mac address of 00:00:00:00:00:00. | 3.7.3-3.7.13 | |
| CM-27192 | If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. | 3.7.10-3.7.13 | |
| CM-27173 | On the Trident3 switch, unicast ARP packets received on a VNI and forwarded to the CPU are not policed. | 3.7.10-3.7.13 | |
| CM-27094 | On the Delta AG9032v1 switch, smonctl and sensors report inaccurate PSU current and power. | 3.5.0-3.7.13 | |
| CM-27018 | If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.13 | |
| CM-26921 | If you delete an undefined bond, then add a bond slave, the net commit command fails. | 3.7.9-3.7.13 | |
| CM-26913 | FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:sudo sh -c “printf ‘interface 50\nvrf TEST description L3 routing interface\n’ » /etc/frr/frr.conf" should be: sudo sh -c “printf ‘interface 50 vrf TEST\ndescription L3 routing interface\n’ » /etc/frr/frr.conf" To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. | 3.7.9-3.7.13 | |
| CM-26905 | When you update the hostname of a switch with the NCLU net add hostname <hostname> command, then run net commit, the lldpd service does not restart and other devices still see the old name.To work around this issue, run the sudo systemctl restart lldpd.service command. | 3.7.10-3.7.13 | |
| CM-26875 | After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. | 3.7.9-3.7.13 | |
| CM-26655 | If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:net add time ntp server 1.2.3.4 iburst If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. | 3.7.9-3.7.13 | |
| CM-26599 | Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. | 3.7.9-3.7.13 | |
| CM-26595 | The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. | 3.7.9-3.7.13 | |
| CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.13 | |
| CM-26463 | The following CVEs affect the linux kernel package: CVE-2019-14821 CVE-2019-14835 CVE-2019-15117 CVE-2019-15118 CVE-2019-15902 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.7.10-3.7.13 | |
| CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.13 | |
| CM-26412 | Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. | 3.7.9-3.7.13 | |
| CM-26288 | On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.13 | |
| CM-26256 | The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. | 3.7.8-3.7.13 | |
| CM-26230 | When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. | 3.7.8-3.7.13 | |
| CM-26139 | Selective ERSPAN does not work when you specify a bridge port. | 3.7.6-3.7.13 | |
| CM-26138 | You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:-A FORWARD -i swp5 -s 00:25:90:b2:bd:9d -d 50:6b:4b:96:c4:04 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64 | 3.7.6-3.7.13 | |
| CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:-A FORWARD -i vni10 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64 | 3.7.6-3.7.13 | |
| CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.13 | |
| CM-26126 | Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.13 | |
| CM-25923 | The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. | 3.7.8-3.7.13 | |
| CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.13 | |
| CM-25859 | The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. | 3.7.7-3.7.13 | |
| CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.13 | |
| CM-25796 | Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:ifdown vlan123 ; sleep 2 ; ifup vlan123 You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. | 3.7.5-3.7.13 | |
| CM-25794 | Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.13 | |
| CM-25766 | On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. | 3.7.7-3.7.13 | |
| CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:cumulus@switch:~$ net add bridge mybridge vlan-protocol 802.1ad | 3.7.6-3.7.13 | |
| CM-25694 | If a packet is policed by ebtables, it does not increment an ACL drop on the ingress interface. Instead, it increments the TDBGC3/6 drop counter to the CPU. | 3.7.6-3.7.13 | |
| CM-25404 | hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. | 3.7.6-3.7.13 | |
| CM-25400 | If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. | 3.7.6-3.7.13 | |
| CM-25397 | When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. | 3.7.3-3.7.13 | |
| CM-25001 | The following CVEs were announced in Debian Security Advisory DSA-444-1, DSA-4447-1 and affect the linux kernel and microcode. Package: linux CVE ID: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 Multiple researchers have discovered vulnerabilities in the way the Intel processor designs have implemented speculative forwarding of data filled into temporary microarchitectural structures (buffers). This flaw could allow an attacker controlling an unprivileged process to read sensitive information, including from the kernel and all other processes running on the system or cross guest/host boundaries to read host memory. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details. To fully resolve these vulnerabilities it is also necessary to install updated CPU microcode. Contact your hardware ndor for microcode uppdates. In addition, this update includes a fix for a regression causing deadlocks inside the loopback driver. Fixed in version 4.19.76-1+cl4u1 | 3.0.0-3.7.13 | |
| CM-24894 | The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. | 3.7.5-3.7.13 | |
| CM-24803 | On the Dell N3048EP-ON or the Delta AG6248 switch, when you execute the following command, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The Cumulus Linux image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new Cumulus Linux image.The workaround only works when an out-of-band network is present. | 3.7.6-3.7.13 | |
| CM-24799 | On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. | 3.7.5-3.7.13 | |
| CM-24751 | On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. | 3.7.3-3.7.13 | |
| CM-24703 | The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.13 | |
| CM-24686 | On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. | 3.7.3-3.7.13 | |
| CM-24652 | In an EVPN environment, the centralized MAC address is not installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN. This issue does not affect a pure distributed routing (symmetric or asymmetric) environment or a pure centralized routing environment. | 3.7.0-3.7.13 | |
| CM-24618 | If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:ERROR: No closing quotation See /var/log/netd.log for more details. | 3.6.1-3.7.13 | |
| CM-24473 | SNMP incorrectly requires engine ID specification. | 3.7.4-3.7.13 | |
| CM-24435 | When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect: net add routing route-map Proxy-ARP permit 25 match interface swp9-10 These commands are correct: net add routing route-map Proxy-ARP permit 25 match interface swp9 net add routing route-map Proxy-ARP permit 30 match interface swp10 | 3.7.2-3.7.13 | |
| CM-24426 | NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf <name> command just displays
Tab completion for the net add vrf <name> ip address <address> command works correctly. | 3.7.4-3.7.13 | |
| CM-24379 | On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.13 | |
| CM-24343 | The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. | 3.7.4-3.7.13 | |
| CM-24332 | On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. | 3.7.3-3.7.13 | |
| CM-24272 | When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface br0.100 switch(config-if)# vrrp 1 priority 110 switch(config-if)# vrrp 1 advertisement-interval switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.13 | |
| CM-24271 | On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface vlan100 switch(config-if)# vrrp 1 priority 110 switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.13 | |
| CM-24270 | Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface swp4 switch(config-if)# vrrp 1 version 2 switch(config-if)# no vrrp 1 preempt switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.13 | |
| CM-24262 | NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto <iface> lines exist. | 3.7.3-3.7.13 | |
| CM-24241 | When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:cumulus@switch:~$ net del bgp neighbor fabric peer-group ‘router bgp 65001’ configuration does not have ‘neighbor fabric peer-group’ | 3.7.2-3.7.13 | |
| CM-24222 | When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. | 3.7.0-3.7.13 | |
| CM-24035 | On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. | 3.7.2-3.7.13 | |
| CM-23825 | The net add interface <interface> ptm-enable command adds no ptm-enable for that interface in the frr.conf file.Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. | 3.7.2-3.7.13 | |
| CM-23792 | When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table.To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev <interface> command. | 3.7.0-3.7.13 | |
| CM-23696 | IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. | 3.7.2-3.7.13 | |
| CM-23665 | NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan <layer3-vni> bridge access <vlan>. This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.To restore connectivity, remove the VLAN ID from the bridge. | 3.7.2-3.7.13 | |
| CM-23661 | On the Mellanox switch, when you configure a GRE tunnel, the traffic behind the local tunnel endpoint destined through the GRE tunnel is software-forwarded. | 3.7.2-3.7.13 | |
| CM-23651 | In an EVPN symmetric routing configuration, when an IP address is frozen, kernel neighbor table information and kernel VRF routing table information about the frozen IP address might be out-of-sync. | 3.7.3-3.7.13 | |
| CM-23584 | When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. | 3.7.2-3.7.13 | |
| CM-23570 | On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. | 3.7.2-3.7.13 | |
| CM-23422 | portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. | 3.7.0-3.7.13 | |
| CM-23418 | For QSFP modules, the sudo ifdown command does not disable the Tx laser. | 3.7.2-3.7.13 | |
| CM-23417 | If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. | 3.7.0-3.7.13 | |
| CM-23397 | On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. | 3.6.2-3.7.13 | |
| CM-23125 | The OpenSSL package on Cumulus Linux 3.x has a vulnerability similar to CVE-2018-0734. (The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key). According to Debian upstream, this version “is not vulnerable [to CVE-2018-0734 exactly]. Nevertheless, there is a bug fix that futher reduces the amount of leaked timing information. It got no CVE on its own and introduced this vulnerability.“ Vulnerable on CL3: 1.0.1t-1+deb8u12 | 3.0.0-3.7.13 | |
| CM-23123 | When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. | 3.7.2-3.7.13 | |
| CM-23075 | There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:2018-11-10T23:35:30.992370-08:00 Dev dhcrelay: Listening on LPF/vlan.101/a0:00:00:00:00:51 2018-11-10T23:35:30.993472-08:00 Dev dhcrelay: Sending on LPF/vlan.101/a0:00:00:00:00:51 Eventually the dhcrelay service stops. | 3.7.1-3.7.13 | |
| CM-23021 | When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. | 3.7.1-3.7.13 | |
| CM-23004 | The local fallback account authenticates using the local password when the RADIUS or TACACS service is up. The expected behavior is for this to fail and only succeed when the RADIUS OR TACACS server fails to respond. | 3.7.1-3.7.13 | |
| CM-22937 | NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation.To work around this issue, stop snmpd, remove the cache file, then restart snmpd. | 3.6.0-3.7.13 | |
| CM-22849 | When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur.This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. | 3.7.2-3.7.13 | |
| CM-22808 | When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. | 3.5.2-3.7.13 | |
| CM-22794 | The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. | 3.6.2-3.7.13 | |
| CM-22583 | Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. | 3.6.0-3.7.13 | |
| CM-22554 | If you try to bring down several members of a bond remotely at the same time, the link state of one of the interfaces might not transition correctly to the down state; however, all links show down in hardware. | 3.6.2-3.7.13 | |
| CM-22386 | The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. | 3.7.0-3.7.13 | |
| CM-22301 | For an unresolved address, the IPROUTER default policer rule has been modified to not match on packets exiting a TUNNEL and headed to the CPU to resolve the address via ARP. As a result, the following default rule no longer matches TUNNEL ingress packets.A $INGRESS_CHAIN –in-interface $INGRESS_INTF -m addrtype –dst-type IPROUTER -j POLICE –set-mode pkt –set-rate 400 –set-burst 100 These packets are now policed by catch all rules. To work around this issue, the VPORT value on a TRIDENT switch must be changed from binary 011 to 100. | 3.6.1-3.7.13 | |
| CM-22287 | On the EdgeCore AS7712 (Tomahawk) switch running in atomic mode, when a layer 3 ECMP path is brought down, traffic traversing the path stops working for about four seconds. When the switch is changed to non-atomic mode, the delay is less than one second. This issue is seen across OSPF and static ECMP routes. | 3.6.2-3.7.13 | |
| CM-22274 | To ease interoperation with non-Cumulus devices, it is possible to configure the route-target import and export values under the layer 2 VNI EVPN configuration. The same configuration does not work for both layer 2 VNI and layer 3 VNIs. Set the EVPN address-family within the VNI context when configuring the route-target in the layer 2 VNI. Set the EVPN address-family without the VNI context when configuring the route-target in the layer 3 VNI. | 3.6.0-3.7.13 | |
| CM-22252 | On the Edgecore OMP-800, there is no Power Supply information from the sensor or from smonctl. The platform driver has support for the PSUs but this was not added to the sensors infrastructure.This is a known limitation on the OMP-800 platform. | 3.6.2-3.7.13 | |
| CM-22228 | On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.13 | |
| CM-22205 | If a user is in vtysh when FRR is restarted, the running configuration in that vtysh session shows empty. | 3.6.2-3.7.13 | |
| CM-22138 | When you run the NCLU net show system command or the NetQ netq inventory command on the Edgecore OMP-800 switch, the output does not show any port or chip information. | 3.6.2-3.7.13 | |
| CM-22041 | At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. | 3.4.3-3.7.13 | |
| CM-22020 | On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. | 3.7.0-3.7.13 | |
| CM-21927 | When running ifreload on Mellanox Spectrum devices, after updating an interface configuration, sometimes VLANs are not programmed into the hardware data plane. The Linux control plane looks normal but the VLAN has not been programmed into the hardware and packets that arrive for the VLAN might be dropped.To work around this issue, remove and re-add the affected VLANs from the port. | 3.5.3-3.7.13 | |
| CM-21898 | On a Trident3 switch, IGMP packets are not policed by the police rule in the 00control ACL file. The packets are policed by the catchall policer in the 99control ACL file instead.-A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police --set-mode pkt --set-rate 100 --set-burst 100To work around this issue, let the CPU bound IGMP packet hit the following rule and change the policer rate to a desired value for IGMP packets: -A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police --set-mode pkt --set-rate 100 --set-burst 100Typically, the destination MAC address 01:00:5e:xx:xx:xx is used only for PIM/IGMP control and data stream packets. However, this workaround cannot handle data stream multicast packets that are not TCP/UDP; this is not typically done. | 3.6.2-3.7.13 | |
| CM-21785 | The source address of the ICMPv6 time exceeded message (traceroute hop) is sourced from the wrong VRF when the traceroute target resides on the same switch but in a different VRF. | 3.6.2-3.7.13 | |
| CM-21769 | On the Mellanox switch, GRE tunneling does not work if the tunnel source is configured on an SVI interface. If the tunnel source is configured on a physical switch port, then tunneling works as expected. | 3.6.1-3.7.13 | |
| CM-21678 | On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty: cumulus@switch:~$ netq show sensors temp changes | grep absent | grep -v psu P2Leaf01 temp9 networking asic die temp sensor absent 43 105 100 5 Unable to find driver path: /cumulu Add 7d:22h:1m:41s P2Leaf01 temp6 networking asic die temp sensor absent 45 105 100 5 Unable to find driver path: /cumulu Add 7d:22h:1m:41s P2Leaf01 temp6 networking asic die temp sensor absent 47 105 100 5 Unable to read temp4_highest Add 9d:23h:26m:6s P2Leaf01 temp6 networking asic die temp sensor absent 45 105 100 5 Unable to read temp4_highest Add 14d:22h:46m:45s This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response. | 3.5.3-3.7.13 | |
| CM-21667 | FRR does not add BGP ttl-security to either the running configuration or to the /etc/frr/frr.conf file when configured on a peer group instead of a specific neighbor.To work around this issue, add ttl-security to individual neighbors instead of the peer group. | 3.6.1-3.7.13 | |
| CM-21379 | If a primary route becomes unavailable (for example, you run ifdown on the switch port), the backup route remains inactive and is not installed into FIB.To work around this issue, configure routes as ECMP: cumulus@switch:~$ net del routing route 4.1.1.0/24 1.1.1.1 10 cumulus@switch:~$ net add routing route 4.1.1.0/24 1.1.1.1 cumulus@switch:~$ net commit | 3.5.3-3.7.13 | |
| CM-21332 | When two VLAN subinterfaces are bridged to each other in a traditional mode bridge, switchd doesn’t assign a gport to the subinterface, even though a gport is expected for each VLAN subinterface.To work around this issue, you can do one of two things:
| 3.5.3-3.7.13 | |
| CM-21058 | The advertised routes list may be empty for an EVPN peering even though the remote switch reports received routes. | 3.6.0-3.7.13 | |
| CM-21055 | On the Mellanox switch, the destination MAC address of ERSPAN GRE packets is set to all zeros; therefore, the first transit switch might drop packets. | 3.6.0-3.7.13 | |
| CM-20813 | Span rules matching the out-interface as a bond do not mirror packets. | 3.6.0-3.7.13 | |
| CM-20693 | In NCLU, you can only set the community number in a route map. You cannot set other community options such as no-export, no-advertise, or additive.This is a known limitation in network-docopt and is documented in the Cumulus Linux user guide. | 3.5.1-3.7.13 | |
| CM-20508 | The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. | 3.5.3-3.7.13 | |
| CM-20480 | The python-crypto package, which is not installed by default on Cumulus Linux, but is present in the repository to be installed, has the following security vulnerability in the version available for Cumulus Linux 3.x: CVE-2018-6594: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto’s ElGamal implementation. More information at https://security-tracker.debian.org/tracker/CVE-2018-6594 . | 3.0.0-3.7.13 | |
| CM-20033 | The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down. | 3.5.2-3.7.13 | |
| CM-19788 | If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict.To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. | 3.5.0-3.7.13 | |
| CM-19724 | PIM and MSDP entries are set to the internal COS value of 6 so they are grouped together with the bulk traffic priority group in the default traffic.conf file. However, PIM, IGMP, and MSDP are considered control-plane and should be set to the internal COS value of 7. | 3.5.2-3.7.13 | |
| CM-19454 | When you use NCLU to bring a bond admin down (net add bond <bond> link down), the bond interface goes into admin down state but the switch ports enslaved to the bond remain UP. If you are using bond-lacp-bypass-allow or balance-xor mode, the host might continue to send traffic. This traffic will be dropped because although the bond slaves are UP, they are not members of the bridge.To work around this issue, use the sudo ifdown <bondname> command. | 3.5.0-3.7.13 | |
| CM-18192 | In FRR, bgp_snmp does not show all BGP peers when peer groups used. | 3.7.11-3.7.13 | |
| CM-17934 | FRR tracks interface speed based on the value it learns from the Linux kernel for that interface. If the interface speed changes, FRR does not update its interface speed cache. This can lead to issues for routing protocols that derive metrics from interface speed as the cost can become out of sync with the interface speed. To work around this issue, manually define the routing protocol metric for these interfaces or restart FRR. | 3.7.6-3.7.13 | |
| CM-17557 | When sFlow is enabled, some sampled packets, such as IPMC, are forwarded twice (in the ASIC and then again through the kernel networking stack). | 3.4.0-3.7.13 | |
| CM-17494 | In certain cases, a peer device sends an ARP request from a source IP address that is not on the connected subnet and the switch creates a STALE neighbor entry. Eventually, the switch attempts to keep the entry fresh and sends ARP requests to the host. If the host responds, the switch has REACHABLE neighbor entries for hosts that are not on the connected subnet. To work around this issue, change the value of arp_ignore to 2. See Default ARP Settings in Cumulus Linux for more information. | 3.3.2-3.7.13 | |
| CM-16855 | If a two nodes on both sides of a link change from auto-negotiation off to auto-negotiation on for both sides during a short interval (around one second), the link might start flapping or stay down.To work around this issue and stop the flapping, turn the link down on the switch with the command ifdown swpX, wait a few seconds, then bring the link back up with the command ifup swpX. Repeat this on the other side if necessary. | 3.3.2-3.7.13 | |
| CM-16571 | NCLU cannot manage rsyslog to addresses routed via a VRF. In Cumulus Linux 4.0.0 and later, management VRF is enabled by default. To work around this issue, update the /etc/network/interfaces file to disable management VRF. | 3.4.3-3.7.13 | |
| CM-16461 | After booting a Cumulus VX virtual machine running the VMware OVA image, sometimes messages from sensors appear, indicating that the “Avg state” is critical, with all values displayed as 100.0. A cl-support is generated. | 3.4.2-3.7.13 | |
| CM-15812 | Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. | 3.2.1-3.7.13 | |
| CM-15601 | On a Mellanox switch in an MLAG environment, a packet from a dually connected host might ingress on one switch but the MAC DA is destined to the router on the peer switch. The packet will traverse the peer link but is not excluded from port isolation (or egress mask) filtering. Similarly, an IP multicast packet might traverse the peer link and need to be routed. | 3.6.2-3.7.13 | |
| CM-15094 | Counter samples for an 80G bond (2 x 40G) exported from the switch show an interface speed (ifSpeed) of 14.464Gbps. | 3.2.0-3.7.13 |
Fixed issues in 3.7.13
| Issue ID | Description | Affects |
|---|---|---|
| CM-29518 | The following vulnerability affects the ruby2.1 package, which is installed by default: CVE-2020-10663: The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.1 has an unsafe object creation vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. Vulnerable: 2.1.5-2+deb8u9 Fixed: 2.1.5-2+deb8u10 | 3.0.0-3.7.12 |
| CM-29484 | The following vulnerability affects libgd2/libgd3: CVE-2018-14553: gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled). Vulnerable: <= 2.1.0-5+deb8u13 Fixed: 2.1.0-5+deb8u14 | 3.0.0-3.7.12 |
| CM-29483 | The following vulnerability affects imptool: CVE-2020-5208: It’s been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. Vulnerable: <= 1.8.14-4 Fixed: 1.8.14-4+deb8u1 | 3.0.0-3.7.12 |
| CM-29322 | When the BGP Multi-protocol Unreach NLRI attribute is received in a BGP update without a next hop attribute, the BGP session is brought down unexpectedly. RFC 4760 defines that the next-hop attribute is not required for updates containing MP_UNREACH_NLRI. | 3.7.12 |
| CM-29284 | The following vulnerabilities affect git, which is available in the repository for optional installation: CVE-2020-5260: Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. CVE-2020-11008: Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. | 3.0.0-3.7.12 |
| CM-29208 | The following vulnerability has been announced in ceph; the associated libraries librados2 and librbd1 are available in the Cumulus Linux 3 repository for optional installation. CVE-2020-1760: It was discovered that there was a header-splitting vulnerability in ceph, a distributed storage and file system. Vulnerable: <= 0.80.7-2+deb8u2 Fixed: 0.80.7-2+deb8u4 | 3.0.0-3.7.12 |
| CM-29048 | The following vulnerability exists in the ruby2.1 package: CVE-2016-2338: An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer “head” allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow Vulnerable: <= 2.1.5-2+deb8u8 Fixed: 2.1.5-2+deb8u9 | 3.0.0-3.7.12 |
| CM-29044 | A large number of flapping peers causes FRR to require a corresponding update to internal data structures that track peer information. Updating this internal data structure does not delete links that are down due to the flapping. The size of this array then grows to contain both current peers as well as peers that should have been deleted during the flap processing. The contents of this array is processed by FRR to poll the links, which consumes CPU for all items in the array. This additional polling consumes more CPU than necessary but has no functional impact. To work around this issue, restart FRR. | 3.7.11-3.7.12 |
| CM-29040 | The following issue has been found in e2fsprogs, a package that contains ext2/ext3/ext4 file system utilities:CVE-2019-5188: A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. | 3.0.0-3.7.12 |
| CM-28995 | After you flap an MLAG peerlink, a rare condition might occur where routes and neighbors for VXLAN-enabled VLANs are misprogrammed as non-VXLAN routes and neighbors due to VNI state transitions. This results in a forwarding failure for traffic destined to these misprogrammed routes and neighbors. Note: Do not flap a VNI interface manually. The only expected time for a VNI interface to go down is when the MLAG secondary switch brings the VNIs protodown during a peer link failure where the backup IP address is still active. To recover from this condition, restart switchd with the sudo systemctl restart switchd command. | 3.7.10-3.7.12 |
| CM-28993 | The following security vulnerability has been announced that affects the libicu52 package: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. Vulnerable: <= 52.1-8+deb8u7 Fixed: 52.1-8+deb8u8 | 3.0.0-3.7.12 |
| CM-28992 | The following security vulnerability has been announced: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. | 3.0.0-3.7.12 |
| CM-28954 | The python-twisted-* packages, which are available for optional installation in Cumulus Linux but are not installed by default, were found to have the following security vulnerabilities: CVE-2020-10808: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request. CVE-2020-10809: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request. | 3.0.0-3.7.12 |
| CM-28867 | The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12 |
| CM-28811 | The following security vulnerability affects the libvpx1 library:CVE-2020-0034: It was discovered that there was an out-of-bounds buffer read vulnerability in libvpx, a library implementing the VP8 & VP9 videocodecs. | 3.0.0-3.7.12 |
| CM-28658 | The OVSDB log contains duplicate MAC addresses with the well-known BFD MAC address (00:23:20:00:00:01). This is mainly cosmetic, but clutters the log. | 3.7.12 |
| CM-28656 | In OVSDB VLAN-aware mode, removing a VTEP binding on the NSX controller fails to clean up all interfaces associated with the logical switch. | 3.7.12 |
| CM-28655 | When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.6.1-3.7.12 |
| CM-28374 | When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-3.7.12 |
| CM-28371 | On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-3.7.12 |
| CM-28340 | Mellanox switches with the Spectrum A0 ASIC that are integrated with VMware NSX experience BFD connectivity issues with service nodes. As a result, VXLAN tunnels do not work. Mellanox switches with the Spectrum A1 ASIC do not have this issue. | 3.7.11-3.7.12 |
| CM-28331 | When you add a route map to advertise IPv4 unicast in a BGP EVPN configuration and the route map contains a set operation, BGP crashes. | 3.7.11-3.7.12 |
| CM-28223 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-1711: block: iscsi: OOB heap access via an unexpected response of iSCSI Server | 3.0.0-3.7.12 |
| CM-28160 | On the Broadcom Trident3 switch with DHCP relay, where the DHCP server is reachable through the EVPN overlay, DHCP discover packets forwarded to the CPU might appear corrupt and might not get forwarded. | 3.7.9-3.7.12 |
| CM-28086 | The ospfd daemon might crash with the following kernel trace:2019-11-06T23:00:08.261749+09:00 cumulus ospfd[5339]: Assertion ‘node’ failed in file ospfd/ospf_packet.c, line 671, function ospf_write | 3.7.11-3.7.12 |
| CM-27982 | On Broadcom switches, switchd crashes when dynamic VRF route leaking is enabled and the following is true:
| 3.7.10-3.7.12 |
| CM-27646 | Several vulnerabilities have been discovered in Git, a fast, scalable, distributed revision control system, which is available in the Cumulus Linux 3.x repositories for optional installation. CVE-2019-1348: export-marks is insecure, fix is to disable by default. CVE-2019-1349: .git / git~1 filename vulnerability on NTFS CVE-2019-1352: .git vulnerability with NTFS Alternate Streams Accesses CVE-2019-1353: NTFS filesystem protection should be on by default CVE-2019-1387: dubiously-nested submodule git directories should be disallowed CVE-2019-19604: submodule update repository code execution vulnerability Vulnerable: <= 2.1.4-2.1+deb8u7 Fixed: 2.1.4-2.1+deb8u8 | 3.0.0-3.7.12 |
| CM-27586 | CPU usage might be higher than normal if you have a high number of interfaces x VLANs and lldpd is active. This issue is introduced with code changes in Cumulus Linux 3.7.11, where VLAN information is now available for LLDP to advertise to neighbors (https://docs.cumulusnetworks.com/version/cumulus-linux-37/Layer-2/Link-Layer-Discovery-Protocol/#vlan-dot1-tlv). You might see high CPU usage even if VLAN (dot1) TLV configuration is disabled.To check if lldpd is the heavy CPU resource user, run the following command:cumulus@switch:~$ ps -eo user,pid,ppid,cmd,%mem,%cpu –sort=-%cpu | head Alternatively, check for messages in the /var/log/syslog directory similar to:2020-02-20T15:02:12.137857-05:00 leaf01 sysmonitor: High CPU use: 87% Note: The exact amount of CPU usage varies in each network based on a number of factors; however, it is unusual for lldpd to consume more than 30% CPU for an extended period of time.To work around this issue, you can do one of the following:
| 3.7.11-3.7.12 |
| CM-26225 | On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:2019-09-05T05:15:17.246597+00:00 hp-6712-03 decode-syseeprom: Unable to find eeprom at /sys/bus/i2c/devices/11-0050/eeprom for psu2 | 3.7.9-3.7.12 |
| CM-26024 | On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. | 3.7.7-3.7.12 |
| CM-25641 | If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl.To work around this issue, power cycle the switch. | 3.7.6-3.7.12 |
3.7.12 Release Notes
Open issues in 3.7.12
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-29759 | When you use nginx and restserver in management VRF to provide a REST API for the switch, nginx starts but restserver fails to start.To work around this issue, comment out the Requires= line in the /lib/systemd/system/restserver.service. For example:#Requires=nginx.service restserver.socket | 3.7.12 | |
| CM-29740 | The exim4 package available for optional installation on Cumulus Linux 3.x has the following vulnerability:DLA-2213-1 / CVE-2020-12783: Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. The spa authentication driver is not enabled by default. Vulnerable: <= 4.84.2-2+deb8u6 Fixed: 4.84.2-2+deb8u7 | 3.0.0-3.7.12 | |
| CM-29667 | After installing Cumulus Linux on the Mellanox SN2100 switch, if you break out a port (for example, if you break out swp1 into four ports: swp1s0, swp1s1, swp1s2, swp1s3) in the /etc/cumulus/ports.conf file, then run the systemctl start switchd command, the update does not take effect.To work around this issue, run the systemctl restart switchd command. | 3.7.12 | |
| CM-29594 | When you run an Ansible script to replace the /etc/network/interfaces file, then run the ifreload -a command, you see errors similar to the following:error: swp1s1.2: netlink: cannot set link swp1s1.2 up: operation failed with ‘Network is down’ (100) To work around this issue, run the ifreload -a command a second time. | 3.7.12 | |
| CM-29562 | If you have an SVI with multiple VRR IP addresses and try to delete one of the VRR configurations, net commit or ifreload -a returns an error. | 3.7.12 | |
| CM-29556 | CVE-2020-11868: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp. This affects: ntp-4.2.8p12 (possibly earlier) and ntp-4.2.8p13 The fix for https://bugs.ntp.org/3445 introduced a bug whereby a system that is running ntp-4.2.8p12 or p13 that only has one unauthenticated time source can be attacked in a way that causes the victim’s next poll to its source to be delayed, for as long as the attack is maintained. http://support.ntp.org/bin/view/Main/NtpBug3592 gives the following mitigations if it is not possible to upgrade to a version with the fix:
| 3.0.0-3.7.12 | |
| CM-29546 | In vtysh, if you configure, then remove a layer 3 VNI for a VRF, the VNI is removed from zebra even if the VNI interface still exists in the kernel. If you configure a layer 2 VNI as a layer 3 VNI by mistake, removing the layer 3 VNI binding removes it from zebra but EVPN-learned MACs and neighbors are not installed into the kernel. To work around this issue, delete, then re-add the missing VNI. For example: cumulus@switch:~$ sudo ifdown vni10100 If you flap the link with the ip link set vni10100 down; ip link set vni10100 up commands, zebra does not re-add the VNI. | 3.7.12 | |
| CM-29525 | The asic-monitor.service fails when you configure /etc/cumulus/datapath/monitor.conf with monitor.histogram_pg.collect.port_group_list = <span class="error">[all_packet_pg]</span> and there is traffic passing through the buffer. When the service fails, you see the following traceback in journalctl:asic-monitor[7389]: asic-monitor-module INFO: 2020-05-01 18:28:12.548734: Egress queue(s) greater than 500 bytes in monitor port group histogram_pg | 3.7.11-3.7.12 | |
| CM-29519 | The JSON format output of the net show bgp l2vpn evpn summary command shows the incorrect neighbour state. | 3.7.12 | |
| CM-29518 | The following vulnerability affects the ruby2.1 package, which is installed by default: CVE-2020-10663: The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.1 has an unsafe object creation vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. Vulnerable: 2.1.5-2+deb8u9 Fixed: 2.1.5-2+deb8u10 | 3.0.0-3.7.12 | |
| CM-29492 | When you create SPAN or ERSPAN rules in ebtables, the action fails to install if it is not in lowercase. Make sure that the SPAN or ERSPAN action is all lowercase; for example:[ebtables] | 3.7.12 | |
| CM-29484 | The following vulnerability affects libgd2/libgd3: CVE-2018-14553: gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled). Vulnerable: <= 2.1.0-5+deb8u13 Fixed: 2.1.0-5+deb8u14 | 3.0.0-3.7.12 | |
| CM-29483 | The following vulnerability affects imptool: CVE-2020-5208: It’s been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. Vulnerable: <= 1.8.14-4 Fixed: 1.8.14-4+deb8u1 | 3.0.0-3.7.12 | |
| CM-29367 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-3.7.12 | |
| CM-29322 | When the BGP Multi-protocol Unreach NLRI attribute is received in a BGP update without a next hop attribute, the BGP session is brought down unexpectedly. RFC 4760 defines that the next-hop attribute is not required for updates containing MP_UNREACH_NLRI. | 3.7.12 | |
| CM-29309 | When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. | 3.7.11-3.7.12 | |
| CM-29284 | The following vulnerabilities affect git, which is available in the repository for optional installation: CVE-2020-5260: Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. CVE-2020-11008: Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. | 3.0.0-3.7.12 | |
| CM-29259 | You might see the following gport error messages in switchd.log:
These messages are harmless and can be ignored. | 3.7.12 | |
| CM-29208 | The following vulnerability has been announced in ceph; the associated libraries librados2 and librbd1 are available in the Cumulus Linux 3 repository for optional installation. CVE-2020-1760: It was discovered that there was a header-splitting vulnerability in ceph, a distributed storage and file system. Vulnerable: <= 0.80.7-2+deb8u2 Fixed: 0.80.7-2+deb8u4 | 3.0.0-3.7.12 | |
| CM-29165 | An inconsistent link-state advertisement may be seen with FRR/OSPF in some circumstances. For example, when you configure the OSPF default originate route as metric-type 1 with a specific metric, Cumulus Linux shows the default originate route as an external metric-type 2 route with the default metric in the database. This problem has been observed when there are both IPv4 and IPv6 default routes in the routing table. | 3.7.12 | |
| CM-29068 | On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-3.7.12 | |
| CM-29048 | The following vulnerability exists in the ruby2.1 package: CVE-2016-2338: An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer “head” allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow Vulnerable: <= 2.1.5-2+deb8u8 Fixed: 2.1.5-2+deb8u9 | 3.0.0-3.7.12 | |
| CM-29044 | A large number of flapping peers causes FRR to require a corresponding update to internal data structures that track peer information. Updating this internal data structure does not delete links that are down due to the flapping. The size of this array then grows to contain both current peers as well as peers that should have been deleted during the flap processing. The contents of this array is processed by FRR to poll the links, which consumes CPU for all items in the array. This additional polling consumes more CPU than necessary but has no functional impact. To work around this issue, restart FRR. | 3.7.11-3.7.12 | |
| CM-29043 | When a multipath route that contains an EVPN path exists together with an IPv4 BGP path in the VRF, the RMAC to VTEP binding is incorrect. This invalid entry occurs because Cumulus Linux treats IPv4 routes received over the eBGP IPv4 peering incorrectly in the VRF. To work around this issue, remove the unnecessary eBGP IPv4 peering. | 3.7.12 | |
| CM-29040 | The following issue has been found in e2fsprogs, a package that contains ext2/ext3/ext4 file system utilities:CVE-2019-5188: A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. | 3.0.0-3.7.12 | |
| CM-29037 | Silent reboots sometimes occur on the switch with nothing that indicates a reboot reason in the syslog file. | 3.7.12 | |
| CM-28995 | After you flap an MLAG peerlink, a rare condition might occur where routes and neighbors for VXLAN-enabled VLANs are misprogrammed as non-VXLAN routes and neighbors due to VNI state transitions. This results in a forwarding failure for traffic destined to these misprogrammed routes and neighbors. Note: Do not flap a VNI interface manually. The only expected time for a VNI interface to go down is when the MLAG secondary switch brings the VNIs protodown during a peer link failure where the backup IP address is still active. To recover from this condition, restart switchd with the sudo systemctl restart switchd command. | 3.7.10-3.7.12 | |
| CM-28993 | The following security vulnerability has been announced that affects the libicu52 package: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. Vulnerable: <= 52.1-8+deb8u7 Fixed: 52.1-8+deb8u8 | 3.0.0-3.7.12 | |
| CM-28992 | The following security vulnerability has been announced: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. | 3.0.0-3.7.12 | |
| CM-28954 | The python-twisted-* packages, which are available for optional installation in Cumulus Linux but are not installed by default, were found to have the following security vulnerabilities: CVE-2020-10808: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request. CVE-2020-10809: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request. | 3.0.0-3.7.12 | |
| CM-28944 | A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted. To work around this issue, reenter the redistribute <connected\|static> route-map <route-map-name> statement in the configuration. | 3.6.2-3.7.12 | |
| CM-28940 | If you configure aggregate-address <address> summary-only before a component of the same aggregate is injected into the BGP table with the network or redistribute command, when you remove the aggregate-address configuration, the component stays suppressed; it is not advertised to peers. For example:Existing configuration: router bgp 1 If you add network 50.0.0.1/32, you see the following (expected) BGP table entries:Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, Removing aggregate-address 50.0.0.0/8 summary-only at this point results in the following (unexpected) BGP table entry:Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, To work around this issue, remove, then re-add the component prefix routes. | 3.7.12 | |
| CM-28938 | When you install an ACL LOG/DROP rule on a layer 3 ingress interface that is a member of a VRF, traffic that matches this rule is not logged and is still forwarded. To work around this issue, apply the ACL LOG/DROP rule to the VRF device itself or to the layer 2 VNI. | 3.7.6-3.7.12 | |
| CM-28867 | The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12 | |
| CM-28816 | The following security advisory has been announced for bash: CVE-2019-18276 Qualys scan QID 372268 setuid vulnerability When bash or bash scripts are run setuid, bash is supposed to drop privileges, but does so incorrectly, so that an attacker with command access to the shell can use enable -f for runtime loading of a new builtin that calls setuid() to regain dropped privileges.To work around this issue, do not make bash or bash scripts setuid. | 3.0.0-3.7.12 | |
| CM-28811 | The following security vulnerability affects the libvpx1 library:CVE-2020-0034: It was discovered that there was an out-of-bounds buffer read vulnerability in libvpx, a library implementing the VP8 & VP9 videocodecs. | 3.0.0-3.7.12 | |
| CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.12 | |
| CM-28658 | The OVSDB log contains duplicate MAC addresses with the well-known BFD MAC address (00:23:20:00:00:01). This is mainly cosmetic, but clutters the log. | 3.7.12 | |
| CM-28656 | In OVSDB VLAN-aware mode, removing a VTEP binding on the NSX controller fails to clean up all interfaces associated with the logical switch. | 3.7.12 | |
| CM-28655 | When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.6.1-3.7.12 | |
| CM-28613 | In EVPN Active-Active (MLAG) environments, rebooting one member of an MLAG pair should result in the local MAC mobility sequence number reverting to 0. Sometimes a reboot of one MLAG peer results in the local MAC mobility sequence number being set to a non-zero value despite that no more mobility events occur. This issue is cosmetic only, as BGP does not advertise the incorrect sequence number and forwarding entries correctly point to the remote VTEP where the MAC is now located. | 3.7.12 | |
| CM-28611 | In an EVPN Active-Active (MLAG) environment, sometimes a local-to-remote MAC mobility event results in the local sequence number appearing higher than the remote sequence number in zebra. This issue is cosmetic only, as BGP does not advertise the incorrect sequence number and forwarding entries correctly point to the remote VTEP where the MAC is now located. | 3.7.12 | |
| CM-28533 | On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-3.7.12 | |
| CM-28488 | The following CVEs were announced that affect the cron package. All of these require untrusted local user access.CVE-2017-9525 is a local user privilege escalation attack: In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs. CVE-2019-9704, CVE-2019-9705, CVE-2019-9706 are local user denial of service attacks. Note: the fix for CVE-2019-9705 imposes a limitation on the length of a crontab file (the vulnerability was that an unlimited size crontab file could cause excessive memory consumption). https://security-tracker.debian.org/tracker/DLA-1723-1 | 3.0.0-3.7.12 | |
| CM-28487 | The following CVE was announced for rsyslog: CVE-2019-17041 CVE-2019-17042 rsyslogd, when receiving remote log messages and using optional pmaixforwardedfrom or pmcisconames parser modules (not enabled by default on Cumulus Linux), is vulnerable to CVE-2019-17041 and CVE-2019-17042 where malicious messages that appear to be from AIX or Cisco respectively may be caused to skip sanity checks, resulting in incorrect negative lengths causing heap overflows.Do not enable (with $UDPServerRun or $InputTCPServerRun) receiving syslog messages from other hosts by the network. Also, do not enable (with $ModLoad) the vulnerable parsers pmaixforwardedfrom or pmcisconames.<br/>The default /etc/rsyslog.conf file on Cumulus Linux does NOT enable $UDPServerRun or $InputTCPServerRun, so the vulnerability is not network exploitable in the default configuration. In addition, the vulnerable parsers are not enabled in the default configuration. | 3.0.0-3.7.12 | |
| CM-28465 | When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. | 3.7.11-3.7.12 | |
| CM-28462 | On rare occasions, when you upgrade Cumulus Linux with the apt-get upgrade command, the upgrade fails and reports No space left on device. Checking the disk utilization shows that the disk is not full.To work around this issue, run the apt-get upgrade command again and reboot the device if prompted to complete the upgrade. | 3.7.10-3.7.12 | |
| CM-28451 | An error similar to the following shows in syslog for Mellanox switches:2020-02-12T19:59:22.208012+08:00 leaf01 sx_sdk: RM_TABLE: No resources available to add 1 entries to KVD hash Table HW resource To work around this issue, reboot the switch. | 3.7.11-3.7.12 | |
| CM-28442 | PTM mis-detects incorrect hostnames of LLDP neighbors and does not fail them as expected. Instead they end up in an N/A cabling status. | 3.7.11-3.7.12 | |
| CM-28441 | If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. | 3.7.11-3.7.12 | |
| CM-28393 | On the Dell S5232F-ON switch, EVPN and dynamic VRF route leaking results in the CPU forwarding traffic to newly-learned type-2 routes. To work around this issue, restart FRR. | 3.7.9-3.7.12 | |
| CM-28376 | On the Dell S5232F-ON switch, the output of ledmgrd shows amber_blinking but smonctl shows all OK. | 3.7.11-3.7.12 | |
| CM-28374 | When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-3.7.12 | |
| CM-28372 | On the EdgeCore AS7326-56X switch, the default fan speed, which is defined in the thermal specification, results in excessive fan noise. | 3.7.11-3.7.12 | |
| CM-28371 | On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-3.7.12 | |
| CM-28340 | Mellanox switches with the Spectrum A0 ASIC that are integrated with VMware NSX experience BFD connectivity issues with service nodes. As a result, VXLAN tunnels do not work. Mellanox switches with the Spectrum A1 ASIC do not have this issue. | 3.7.11-3.7.12 | |
| CM-28331 | When you add a route map to advertise IPv4 unicast in a BGP EVPN configuration and the route map contains a set operation, BGP crashes. | 3.7.11-3.7.12 | |
| CM-28223 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-1711: block: iscsi: OOB heap access via an unexpected response of iSCSI Server | 3.0.0-3.7.12 | |
| CM-28212 | The hsflowd service sends an undefined header protocol 0 in the sampled flow sample to the collector, which is not recognized by the sFlow tool. You see errors similar to the following:Dec 20 08:43:27 netflow-nms sfcapd[3991]: SFLOW: readFlowSample_header() undefined headerProtocol = 0 | 3.7.11-3.7.12 | |
| CM-28160 | On the Broadcom Trident3 switch with DHCP relay, where the DHCP server is reachable through the EVPN overlay, DHCP discover packets forwarded to the CPU might appear corrupt and might not get forwarded. | 3.7.9-3.7.12 | |
| CM-28136 | The MLAG switch pair has VLANs defined that are not used on MLAG bonds. These VLANs still synchronize MAC addresses across to the peer switch. This results in log messages that indicate a MAC address is installed and the VLAN is not defined; for example:RTM_NEWNEIGH with unconfigured vlan XXXX on port peerlink | 3.7.10-3.7.12 | |
| CM-28086 | The ospfd daemon might crash with the following kernel trace:2019-11-06T23:00:08.261749+09:00 cumulus ospfd[5339]: Assertion ‘node’ failed in file ospfd/ospf_packet.c, line 671, function ospf_write | 3.7.11-3.7.12 | |
| CM-28080 | TACACS+ through ClearPass is not currently supported. Cumulus Linux sends authorization before authentication, but ClearPass does not accept an authorization before the user is authenticated. | 3.7.11-3.7.12 | |
| CM-28078 | On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-3.7.12 | |
| CM-28076 | After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom --init command. | 3.6.0-3.7.12 | |
| CM-28061 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-3.7.12 | |
| CM-28003 | The FRR service does not provide a way for automation to know if the configuration applied properly. To work around this issue, execute the vtysh -f <file> command in the automation file before starting the FRR service to validate the functional configuration and return an error code. | 3.7.11-3.7.12 | |
| CM-27999 | On the EdgeCore AS7326-56X switch, the PSU fans show constant LOW warnings. | 3.7.10-3.7.12 | |
| CM-27982 | On Broadcom switches, switchd crashes when dynamic VRF route leaking is enabled and the following is true:
| 3.7.10-3.7.12 | |
| CM-27957 | If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:bq. systemd[1]: switchd.service watchdog timeout (limit 2min)! To workaround this issue, either reduce the number of configured interfaces and/or VLANs or increase the systemd timeout for switchd.service.To increase the systemd timeout:
| 3.7.11-3.7.12 | |
| CM-27937 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 One of the listed vulnerabilities is still present in the latest upstream version 2.1+dfsg-12+deb8u12 (the others have been fixed): CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. https://security-tracker.debian.org/tracker/CVE-2017-15124 | 3.0.0-3.7.12 | |
| CM-27814 | A traditional bridge with QinQ and a VNI does not work for tagged traffic. | 3.7.10-3.7.12 | |
| CM-27793 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.27+dfsg-1 Fixed: 2.1.27+dfsg-1+deb10u1 | 3.0.0-3.7.12 | |
| CM-27698 | SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.12 | |
| CM-27646 | Several vulnerabilities have been discovered in Git, a fast, scalable, distributed revision control system, which is available in the Cumulus Linux 3.x repositories for optional installation. CVE-2019-1348: export-marks is insecure, fix is to disable by default. CVE-2019-1349: .git / git~1 filename vulnerability on NTFS CVE-2019-1352: .git vulnerability with NTFS Alternate Streams Accesses CVE-2019-1353: NTFS filesystem protection should be on by default CVE-2019-1387: dubiously-nested submodule git directories should be disallowed CVE-2019-19604: submodule update repository code execution vulnerability Vulnerable: <= 2.1.4-2.1+deb8u7 Fixed: 2.1.4-2.1+deb8u8 | 3.0.0-3.7.12 | |
| CM-27620 | When using QinQ with a traditional bridge, if you enable the LLDP dot1 TLV option, you see the following suboptimal behavior:
| 3.7.11-3.7.12 | |
| CM-27586 | CPU usage might be higher than normal if you have a high number of interfaces x VLANs and lldpd is active. This issue is introduced with code changes in Cumulus Linux 3.7.11, where VLAN information is now available for LLDP to advertise to neighbors (https://docs.cumulusnetworks.com/version/cumulus-linux-37/Layer-2/Link-Layer-Discovery-Protocol/#vlan-dot1-tlv). You might see high CPU usage even if VLAN (dot1) TLV configuration is disabled.To check if lldpd is the heavy CPU resource user, run the following command:cumulus@switch:~$ ps -eo user,pid,ppid,cmd,%mem,%cpu –sort=-%cpu | head Alternatively, check for messages in the /var/log/syslog directory similar to:2020-02-20T15:02:12.137857-05:00 leaf01 sysmonitor: High CPU use: 87% Note: The exact amount of CPU usage varies in each network based on a number of factors; however, it is unusual for lldpd to consume more than 30% CPU for an extended period of time.To work around this issue, you can do one of the following:
| 3.7.11-3.7.12 | |
| CM-27581 | On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel.To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.This workaround only works when an out-of-band network is present. | 3.7.11-3.7.12 | |
| CM-27530 | When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. | 3.7.10-3.7.12 | |
| CM-27522 | The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. | 3.7.10-3.7.12 | |
| CM-27354 | On the Celestica Pebble switch, if you use IPv6 routes with mask /65 to /127, the switchd log fills with errors. | 3.7.10-3.7.12 | |
| CM-27279 | When ECMP routes have both VXLAN (symmetric routing) and non-VXLAN paths, the non-VXLAN path is incorrectly installed in the RIB and FIB to point across VXLAN. The non-VXLAN next-hop will be installed as an offload entry in the neighbor table (ip neigh show) with a mac address of 00:00:00:00:00:00. | 3.7.3-3.7.12 | |
| CM-27192 | If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. | 3.7.10-3.7.12 | |
| CM-27173 | On the Trident3 switch, unicast ARP packets received on a VNI and forwarded to the CPU are not policed. | 3.7.10-3.7.12 | |
| CM-27094 | On the Delta AG9032v1 switch, smonctl and sensors report inaccurate PSU current and power. | 3.5.0-3.7.12 | |
| CM-27018 | If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.12 | |
| CM-26921 | If you delete an undefined bond, then add a bond slave, the net commit command fails. | 3.7.9-3.7.12 | |
| CM-26913 | FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:sudo sh -c “printf ‘interface 50\nvrf TEST description L3 routing interface\n’ » /etc/frr/frr.conf" should be: sudo sh -c “printf ‘interface 50 vrf TEST\ndescription L3 routing interface\n’ » /etc/frr/frr.conf" To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. | 3.7.9-3.7.12 | |
| CM-26905 | When you update the hostname of a switch with the NCLU net add hostname <hostname> command, then run net commit, the lldpd service does not restart and other devices still see the old name.To work around this issue, run the sudo systemctl restart lldpd.service command. | 3.7.10-3.7.12 | |
| CM-26875 | After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. | 3.7.9-3.7.12 | |
| CM-26655 | If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:net add time ntp server 1.2.3.4 iburst If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. | 3.7.9-3.7.12 | |
| CM-26599 | Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. | 3.7.9-3.7.12 | |
| CM-26595 | The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. | 3.7.9-3.7.12 | |
| CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.12 | |
| CM-26463 | The following CVEs affect the linux kernel package: CVE-2019-14821 CVE-2019-14835 CVE-2019-15117 CVE-2019-15118 CVE-2019-15902 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.7.10-3.7.12 | |
| CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.12 | |
| CM-26412 | Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. | 3.7.9-3.7.12 | |
| CM-26288 | On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.12 | |
| CM-26256 | The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. | 3.7.8-3.7.12 | |
| CM-26230 | When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. | 3.7.8-3.7.12 | |
| CM-26225 | On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:2019-09-05T05:15:17.246597+00:00 hp-6712-03 decode-syseeprom: Unable to find eeprom at /sys/bus/i2c/devices/11-0050/eeprom for psu2 | 3.7.9-3.7.12 | |
| CM-26139 | Selective ERSPAN does not work when you specify a bridge port. | 3.7.6-3.7.12 | |
| CM-26138 | You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:-A FORWARD -i swp5 -s 00:25:90:b2:bd:9d -d 50:6b:4b:96:c4:04 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64 | 3.7.6-3.7.12 | |
| CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:-A FORWARD -i vni10 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64 | 3.7.6-3.7.12 | |
| CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.12 | |
| CM-26126 | Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.12 | |
| CM-26024 | On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. | 3.7.7-3.7.12 | |
| CM-25923 | The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. | 3.7.8-3.7.12 | |
| CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.12 | |
| CM-25859 | The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. | 3.7.7-3.7.12 | |
| CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.12 | |
| CM-25796 | Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:ifdown vlan123 ; sleep 2 ; ifup vlan123 You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. | 3.7.5-3.7.12 | |
| CM-25794 | Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.12 | |
| CM-25766 | On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. | 3.7.7-3.7.12 | |
| CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:cumulus@switch:~$ net add bridge mybridge vlan-protocol 802.1ad | 3.7.6-3.7.12 | |
| CM-25694 | If a packet is policed by ebtables, it does not increment an ACL drop on the ingress interface. Instead, it increments the TDBGC3/6 drop counter to the CPU. | 3.7.6-3.7.12 | |
| CM-25641 | If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl.To work around this issue, power cycle the switch. | 3.7.6-3.7.12 | |
| CM-25404 | hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. | 3.7.6-3.7.12 | |
| CM-25400 | If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. | 3.7.6-3.7.12 | |
| CM-25397 | When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. | 3.7.3-3.7.12 | |
| CM-25001 | The following CVEs were announced in Debian Security Advisory DSA-444-1, DSA-4447-1 and affect the linux kernel and microcode. Package: linux CVE ID: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 Multiple researchers have discovered vulnerabilities in the way the Intel processor designs have implemented speculative forwarding of data filled into temporary microarchitectural structures (buffers). This flaw could allow an attacker controlling an unprivileged process to read sensitive information, including from the kernel and all other processes running on the system or cross guest/host boundaries to read host memory. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details. To fully resolve these vulnerabilities it is also necessary to install updated CPU microcode. Contact your hardware ndor for microcode uppdates. In addition, this update includes a fix for a regression causing deadlocks inside the loopback driver. Fixed in version 4.19.76-1+cl4u1 | 3.0.0-3.7.12 | |
| CM-24894 | The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. | 3.7.5-3.7.12 | |
| CM-24803 | On the Dell N3048EP-ON or the Delta AG6248 switch, when you execute the following command, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The Cumulus Linux image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new Cumulus Linux image.The workaround only works when an out-of-band network is present. | 3.7.6-3.7.12 | |
| CM-24799 | On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. | 3.7.5-3.7.12 | |
| CM-24751 | On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. | 3.7.3-3.7.12 | |
| CM-24703 | The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.12 | |
| CM-24686 | On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. | 3.7.3-3.7.12 | |
| CM-24652 | In an EVPN environment, the centralized MAC address is not installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN. This issue does not affect a pure distributed routing (symmetric or asymmetric) environment or a pure centralized routing environment. | 3.7.0-3.7.12 | |
| CM-24618 | If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:ERROR: No closing quotation See /var/log/netd.log for more details. | 3.6.1-3.7.12 | |
| CM-24473 | SNMP incorrectly requires engine ID specification. | 3.7.4-3.7.12 | |
| CM-24435 | When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect: net add routing route-map Proxy-ARP permit 25 match interface swp9-10 These commands are correct: net add routing route-map Proxy-ARP permit 25 match interface swp9 net add routing route-map Proxy-ARP permit 30 match interface swp10 | 3.7.2-3.7.12 | |
| CM-24426 | NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf <name> command just displays
Tab completion for the net add vrf <name> ip address <address> command works correctly. | 3.7.4-3.7.12 | |
| CM-24379 | On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.12 | |
| CM-24343 | The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. | 3.7.4-3.7.12 | |
| CM-24332 | On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. | 3.7.3-3.7.12 | |
| CM-24272 | When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface br0.100 switch(config-if)# vrrp 1 priority 110 switch(config-if)# vrrp 1 advertisement-interval switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24271 | On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface vlan100 switch(config-if)# vrrp 1 priority 110 switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24270 | Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface swp4 switch(config-if)# vrrp 1 version 2 switch(config-if)# no vrrp 1 preempt switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24262 | NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto <iface> lines exist. | 3.7.3-3.7.12 | |
| CM-24241 | When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:cumulus@switch:~$ net del bgp neighbor fabric peer-group ‘router bgp 65001’ configuration does not have ‘neighbor fabric peer-group’ | 3.7.2-3.7.12 | |
| CM-24222 | When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. | 3.7.0-3.7.12 | |
| CM-24035 | On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. | 3.7.2-3.7.12 | |
| CM-23825 | The net add interface <interface> ptm-enable command adds no ptm-enable for that interface in the frr.conf file.Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. | 3.7.2-3.7.12 | |
| CM-23792 | When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table.To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev <interface> command. | 3.7.0-3.7.12 | |
| CM-23696 | IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. | 3.7.2-3.7.12 | |
| CM-23665 | NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan <layer3-vni> bridge access <vlan>. This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.To restore connectivity, remove the VLAN ID from the bridge. | 3.7.2-3.7.12 | |
| CM-23661 | On the Mellanox switch, when you configure a GRE tunnel, the traffic behind the local tunnel endpoint destined through the GRE tunnel is software-forwarded. | 3.7.2-3.7.12 | |
| CM-23651 | In an EVPN symmetric routing configuration, when an IP address is frozen, kernel neighbor table information and kernel VRF routing table information about the frozen IP address might be out-of-sync. | 3.7.3-3.7.12 | |
| CM-23584 | When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. | 3.7.2-3.7.12 | |
| CM-23570 | On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. | 3.7.2-3.7.12 | |
| CM-23422 | portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. | 3.7.0-3.7.12 | |
| CM-23418 | For QSFP modules, the sudo ifdown command does not disable the Tx laser. | 3.7.2-3.7.12 | |
| CM-23417 | If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. | 3.7.0-3.7.12 | |
| CM-23397 | On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. | 3.6.2-3.7.12 | |
| CM-23125 | The OpenSSL package on Cumulus Linux 3.x has a vulnerability similar to CVE-2018-0734. (The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key). According to Debian upstream, this version “is not vulnerable [to CVE-2018-0734 exactly]. Nevertheless, there is a bug fix that futher reduces the amount of leaked timing information. It got no CVE on its own and introduced this vulnerability.“ Vulnerable on CL3: 1.0.1t-1+deb8u12 | 3.0.0-3.7.12 | |
| CM-23123 | When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. | 3.7.2-3.7.12 | |
| CM-23075 | There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:2018-11-10T23:35:30.992370-08:00 Dev dhcrelay: Listening on LPF/vlan.101/a0:00:00:00:00:51 2018-11-10T23:35:30.993472-08:00 Dev dhcrelay: Sending on LPF/vlan.101/a0:00:00:00:00:51 Eventually the dhcrelay service stops. | 3.7.1-3.7.12 | |
| CM-23021 | When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. | 3.7.1-3.7.12 | |
| CM-23004 | The local fallback account authenticates using the local password when the RADIUS or TACACS service is up. The expected behavior is for this to fail and only succeed when the RADIUS OR TACACS server fails to respond. | 3.7.1-3.7.12 | |
| CM-22937 | NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation.To work around this issue, stop snmpd, remove the cache file, then restart snmpd. | 3.6.0-3.7.12 | |
| CM-22849 | When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur.This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. | 3.7.2-3.7.12 | |
| CM-22808 | When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. | 3.5.2-3.7.12 | |
| CM-22794 | The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. | 3.6.2-3.7.12 | |
| CM-22583 | Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. | 3.6.0-3.7.12 | |
| CM-22554 | If you try to bring down several members of a bond remotely at the same time, the link state of one of the interfaces might not transition correctly to the down state; however, all links show down in hardware. | 3.6.2-3.7.12 | |
| CM-22386 | The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. | 3.7.0-3.7.12 | |
| CM-22301 | For an unresolved address, the IPROUTER default policer rule has been modified to not match on packets exiting a TUNNEL and headed to the CPU to resolve the address via ARP. As a result, the following default rule no longer matches TUNNEL ingress packets.A $INGRESS_CHAIN –in-interface $INGRESS_INTF -m addrtype –dst-type IPROUTER -j POLICE –set-mode pkt –set-rate 400 –set-burst 100 These packets are now policed by catch all rules. To work around this issue, the VPORT value on a TRIDENT switch must be changed from binary 011 to 100. | 3.6.1-3.7.12 | |
| CM-22287 | On the EdgeCore AS7712 (Tomahawk) switch running in atomic mode, when a layer 3 ECMP path is brought down, traffic traversing the path stops working for about four seconds. When the switch is changed to non-atomic mode, the delay is less than one second. This issue is seen across OSPF and static ECMP routes. | 3.6.2-3.7.12 | |
| CM-22274 | To ease interoperation with non-Cumulus devices, it is possible to configure the route-target import and export values under the layer 2 VNI EVPN configuration. The same configuration does not work for both layer 2 VNI and layer 3 VNIs. Set the EVPN address-family within the VNI context when configuring the route-target in the layer 2 VNI. Set the EVPN address-family without the VNI context when configuring the route-target in the layer 3 VNI. | 3.6.0-3.7.12 | |
| CM-22252 | On the Edgecore OMP-800, there is no Power Supply information from the sensor or from smonctl. The platform driver has support for the PSUs but this was not added to the sensors infrastructure.This is a known limitation on the OMP-800 platform. | 3.6.2-3.7.12 | |
| CM-22228 | On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.12 | |
| CM-22205 | If a user is in vtysh when FRR is restarted, the running configuration in that vtysh session shows empty. | 3.6.2-3.7.12 | |
| CM-22138 | When you run the NCLU net show system command or the NetQ netq inventory command on the Edgecore OMP-800 switch, the output does not show any port or chip information. | 3.6.2-3.7.12 | |
| CM-22041 | At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. | 3.4.3-3.7.12 | |
| CM-22020 | On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. | 3.7.0-3.7.12 | |
| CM-21927 | When running ifreload on Mellanox Spectrum devices, after updating an interface configuration, sometimes VLANs are not programmed into the hardware data plane. The Linux control plane looks normal but the VLAN has not been programmed into the hardware and packets that arrive for the VLAN might be dropped.To work around this issue, remove and re-add the affected VLANs from the port. | 3.5.3-3.7.12 | |
| CM-21898 | On a Trident3 switch, IGMP packets are not policed by the police rule in the 00control ACL file. The packets are policed by the catchall policer in the 99control ACL file instead.-A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police --set-mode pkt --set-rate 100 --set-burst 100To work around this issue, let the CPU bound IGMP packet hit the following rule and change the policer rate to a desired value for IGMP packets: -A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police --set-mode pkt --set-rate 100 --set-burst 100Typically, the destination MAC address 01:00:5e:xx:xx:xx is used only for PIM/IGMP control and data stream packets. However, this workaround cannot handle data stream multicast packets that are not TCP/UDP; this is not typically done. | 3.6.2-3.7.12 | |
| CM-21785 | The source address of the ICMPv6 time exceeded message (traceroute hop) is sourced from the wrong VRF when the traceroute target resides on the same switch but in a different VRF. | 3.6.2-3.7.12 | |
| CM-21769 | On the Mellanox switch, GRE tunneling does not work if the tunnel source is configured on an SVI interface. If the tunnel source is configured on a physical switch port, then tunneling works as expected. | 3.6.1-3.7.12 | |
| CM-21678 | On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty: cumulus@switch:~$ netq show sensors temp changes | grep absent | grep -v psu P2Leaf01 temp9 networking asic die temp sensor absent 43 105 100 5 Unable to find driver path: /cumulu Add 7d:22h:1m:41s P2Leaf01 temp6 networking asic die temp sensor absent 45 105 100 5 Unable to find driver path: /cumulu Add 7d:22h:1m:41s P2Leaf01 temp6 networking asic die temp sensor absent 47 105 100 5 Unable to read temp4_highest Add 9d:23h:26m:6s P2Leaf01 temp6 networking asic die temp sensor absent 45 105 100 5 Unable to read temp4_highest Add 14d:22h:46m:45s This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response. | 3.5.3-3.7.12 | |
| CM-21667 | FRR does not add BGP ttl-security to either the running configuration or to the /etc/frr/frr.conf file when configured on a peer group instead of a specific neighbor.To work around this issue, add ttl-security to individual neighbors instead of the peer group. | 3.6.1-3.7.12 | |
| CM-21379 | If a primary route becomes unavailable (for example, you run ifdown on the switch port), the backup route remains inactive and is not installed into FIB.To work around this issue, configure routes as ECMP: cumulus@switch:~$ net del routing route 4.1.1.0/24 1.1.1.1 10 cumulus@switch:~$ net add routing route 4.1.1.0/24 1.1.1.1 cumulus@switch:~$ net commit | 3.5.3-3.7.12 | |
| CM-21332 | When two VLAN subinterfaces are bridged to each other in a traditional mode bridge, switchd doesn’t assign a gport to the subinterface, even though a gport is expected for each VLAN subinterface.To work around this issue, you can do one of two things:
| 3.5.3-3.7.12 | |
| CM-21058 | The advertised routes list may be empty for an EVPN peering even though the remote switch reports received routes. | 3.6.0-3.7.12 | |
| CM-21055 | On the Mellanox switch, the destination MAC address of ERSPAN GRE packets is set to all zeros; therefore, the first transit switch might drop packets. | 3.6.0-3.7.12 | |
| CM-20813 | Span rules matching the out-interface as a bond do not mirror packets. | 3.6.0-3.7.12 | |
| CM-20693 | In NCLU, you can only set the community number in a route map. You cannot set other community options such as no-export, no-advertise, or additive.This is a known limitation in network-docopt and is documented in the Cumulus Linux user guide. | 3.5.1-3.7.12 | |
| CM-20508 | The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. | 3.5.3-3.7.12 | |
| CM-20480 | The python-crypto package, which is not installed by default on Cumulus Linux, but is present in the repository to be installed, has the following security vulnerability in the version available for Cumulus Linux 3.x: CVE-2018-6594: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto’s ElGamal implementation. More information at https://security-tracker.debian.org/tracker/CVE-2018-6594 . | 3.0.0-3.7.12 | |
| CM-20033 | The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down. | 3.5.2-3.7.12 | |
| CM-19788 | If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict.To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. | 3.5.0-3.7.12 | |
| CM-19724 | PIM and MSDP entries are set to the internal COS value of 6 so they are grouped together with the bulk traffic priority group in the default traffic.conf file. However, PIM, IGMP, and MSDP are considered control-plane and should be set to the internal COS value of 7. | 3.5.2-3.7.12 | |
| CM-19454 | When you use NCLU to bring a bond admin down (net add bond <bond> link down), the bond interface goes into admin down state but the switch ports enslaved to the bond remain UP. If you are using bond-lacp-bypass-allow or balance-xor mode, the host might continue to send traffic. This traffic will be dropped because although the bond slaves are UP, they are not members of the bridge.To work around this issue, use the sudo ifdown <bondname> command. | 3.5.0-3.7.12 | |
| CM-18192 | In FRR, bgp_snmp does not show all BGP peers when peer groups used. | 3.7.11-3.7.12 | |
| CM-17934 | FRR tracks interface speed based on the value it learns from the Linux kernel for that interface. If the interface speed changes, FRR does not update its interface speed cache. This can lead to issues for routing protocols that derive metrics from interface speed as the cost can become out of sync with the interface speed. To work around this issue, manually define the routing protocol metric for these interfaces or restart FRR. | 3.7.6-3.7.12 | |
| CM-17557 | When sFlow is enabled, some sampled packets, such as IPMC, are forwarded twice (in the ASIC and then again through the kernel networking stack). | 3.4.0-3.7.12 | |
| CM-17494 | In certain cases, a peer device sends an ARP request from a source IP address that is not on the connected subnet and the switch creates a STALE neighbor entry. Eventually, the switch attempts to keep the entry fresh and sends ARP requests to the host. If the host responds, the switch has REACHABLE neighbor entries for hosts that are not on the connected subnet. To work around this issue, change the value of arp_ignore to 2. See Default ARP Settings in Cumulus Linux for more information. | 3.3.2-3.7.12 | |
| CM-16855 | If a two nodes on both sides of a link change from auto-negotiation off to auto-negotiation on for both sides during a short interval (around one second), the link might start flapping or stay down.To work around this issue and stop the flapping, turn the link down on the switch with the command ifdown swpX, wait a few seconds, then bring the link back up with the command ifup swpX. Repeat this on the other side if necessary. | 3.3.2-3.7.12 | |
| CM-16571 | NCLU cannot manage rsyslog to addresses routed via a VRF. In Cumulus Linux 4.0.0 and later, management VRF is enabled by default. To work around this issue, update the /etc/network/interfaces file to disable management VRF. | 3.4.3-3.7.12 | |
| CM-16461 | After booting a Cumulus VX virtual machine running the VMware OVA image, sometimes messages from sensors appear, indicating that the “Avg state” is critical, with all values displayed as 100.0. A cl-support is generated. | 3.4.2-3.7.12 | |
| CM-15812 | Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. | 3.2.1-3.7.12 | |
| CM-15601 | On a Mellanox switch in an MLAG environment, a packet from a dually connected host might ingress on one switch but the MAC DA is destined to the router on the peer switch. The packet will traverse the peer link but is not excluded from port isolation (or egress mask) filtering. Similarly, an IP multicast packet might traverse the peer link and need to be routed. | 3.6.2-3.7.12 | |
| CM-15094 | Counter samples for an 80G bond (2 x 40G) exported from the switch show an interface speed (ifSpeed) of 14.464Gbps. | 3.2.0-3.7.12 |
Fixed issues in 3.7.12
| Issue ID | Description | Affects |
|---|---|---|
| CM-28486 | The following vulnerability has been found in the libgcrypt20 cryptographic library. CVE-2019-13627: there was a ECDSA timing attack. For more information, see https://www.debian.org/lts/security/2020/dla-1931-2.en.html Vulnerable: 1.6.3-2+deb8u7 Fixed: 1.6.3-2+deb8u8 | 3.0.0-3.7.11 |
| CM-28485 | The following vulnerability affects libxml2: CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c has a memory leak related to newDoc->oldNs. This can lead to a denial of service. For more information, see https://www.debian.org/lts/security/2019/dla-2048.en.html . Vulnerable: 2.9.1+dfsg1-5+deb8u7 Fixed: 2.9.1+dfsg1-5+deb8u8 | 3.0.0-3.7.11 |
| CM-28484 | The following vulnerability affects libbsd, a package containing utility functions from BSD systems. CVE-2016-2090: In function fgetwln() an off-by-one error could triggers a heap buffer overflow. For more information, see https://www.debian.org/lts/security/2019/dla-2052.en.html . Vulnerable: 0.7.0-2 Fixed: 0.7.0-2+deb8u1 | 3.0.0-3.7.11 |
| CM-28313 | On the EdgeCore Wedge100 and Facebook Wedge-100S switch, certain physical ports are not correctly mapped to the logical ones. For example: Logical swp39 controls physical swp41 Logical swp40 controls physical swp42 Logical swp43 controls physical swp45 Logical swp44 controls physical swp46 This might causes incorrect forwarding behavior. | 3.7.11 |
| CM-28276 | When a Trident3 switch receives packets containing an IP checksum value that is not compliant with RFC 1624, the TTL is decremented after a routing operation but the checksum is not recalculated. This results in the IP checksum value being invalid as the packet leaves the switch. | 3.7.10-3.7.11 |
| CM-28222 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-7039: tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code. Vulnerable: <= 2.1+dfsg-12+deb8u12 Fixed: 2.1+dfsg-12+deb8u13 | 3.0.0-3.7.11 |
| CM-28219 | The following vulnerability affects sudo, which is installed by default on Cumulus Linux. It is potentially exploitable on Cumulus Linux if pwfeedback (which is NOT enabled by default) is enabled in the /etc/sudoers file. CVE-2019-18634: In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c. For more information, refer to: https://security-tracker.debian.org/tracker/source-package/sudo https://security-tracker.debian.org/tracker/CVE-2019-18634 https://www.sudo.ws/alerts/pwfeedback.html Vulnerable: <= 1.8.10p3-1+deb8u6 Fixed: 1.8.10p3-1+deb8u7 | 3.0.0-3.7.11 |
| CM-28169 | On the Dell Z9264F-ON switch, the CPU core temperature sensors report ABSENT. | 3.7.11 |
| CM-28091 | Two security issues were found in the Python interface to the apt package manager, which is installed by default on Cumulus Linux; package downloads from unsigned repositories were incorrectly rejected (CVE-2019-15796) and the hash validation relied on MD5 (CVE-2019-15795). For more information, refer to https://security-tracker.debian.org/tracker/source-package/python-apt Vulnerable: 0.9.3.12 Fixed: 0.9.3.13 | 3.0.0-3.7.11 |
| CM-28087 | The last eight ports of the EdgeCore AS4610-54P switch (swp41 through swp48) do not power UPOE access points. | 3.7.11 |
| CM-28077 | An unhandled exception might occur after you run the sudo poectl -i command. In addition, random poed daemon restarts can occur without any unhandled exceptions but with an invalid response length error. Both issues can occur due to a SerialException.To work around this issue, power cycle the switch. A software reboot does not resolve the issue. | 3.7.10-3.7.11 |
| CM-28065 | Editing the outbound route-map of a BGP peer causes all received prefixes by that BGP peer to reset and reinstall. This might cause a brief impact to traffic for those prefixes. | 3.7.11 |
| CM-28048 | On the Lenovo NE2580 switch, the fan speeds are higher than expected within normal operating conditions. | 3.7.11 |
| CM-28038 | After you convert a bond back to a layer 2 access port, ifupdown2 changes all SVI MTUs to 1500. To work around this issue, run ifreload -a a second time. | 3.7.11 |
| CM-28016 | On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. | 3.7.7-3.7.11 |
| CM-28007 | When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 |
| CM-27947 | Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. | 3.7.0-3.7.11 |
| CM-27927 | On the Delta AG6248C switch, the NCLU net show system sensors command shows an error:Could not collect output from command: ['/usr/sbin/smonctl’] To work around this issue, run the net show system sensors json command instead. | 3.7.11 |
| CM-27924 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.26.dfsg1-13+deb8u1 Fixed: 2.1.26.dfsg1-13+deb8u2 | 3.0.0-3.7.11 |
| CM-27855 | The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. | 3.7.0-3.7.11 |
| CM-27804 | You might see a switchd memory leak during ECMP group expansion or consolidation. | 3.7.10-3.7.11 |
| CM-27764 | On the EdgeCore AS7326-56X switch, eth0 and swp1 use the same MAC address. | 3.7.9-3.7.11 |
| CM-27737 | On the EdgeCore AS7326-56X switch, you might see the RPM of certain fans run over the maximum threshold. | 3.7.11 |
| CM-27683 | The following CVEs were announced that affect the Linux kernel: CVE-2019-12378: An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-12381: An issue was discovered in ip_ra_control in net/ipv4/ip_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-15239: In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation. CVE-2019-19062: A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042. CVE-2019-19537: In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID-303911cfc5b9. This affects drivers/usb/core/file.c. CVE-2019-20054: In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e. | 3.0.0-3.7.11 |
| CM-27670 | A memory leak in switchd might occur, which causes switchd to restart. | 3.7.10-3.7.11 |
| CM-27644 | Ifupdown2 does not set up the front panel interface for the dhclient to accept the DHCP OFFER.To work around this issue, restart the networking service after ifreload -a with the systemctl restart networking command. | 3.7.10-3.7.11 |
| CM-27525 | On the Delta AG6248C PoE switch, if the PoE priority is set to low on some ports, other ports with a higher priority might have their requests to draw power rejected instead of the lower priority ports being brought down. | 3.7.11 |
| CM-27507 | The ports.conf file on the Dell S5248F-ON switch does not show port ganging or breakout options. | 3.7.10-3.7.11 |
| CM-27496 | All Broadcom Trident3 X7 switches contain PCIE firmware, which is programmed by the vendor when the switch is manufactured. The latest version of this firmware (2.6) is incompatible with Cumulus Linux 3.7.11 and earlier, and Cumulus Linux 4.0. To work around this issue, downgrade the Broadcom ASIC firmware to an earlier version. | 3.7.11 |
| CM-27444 | If you use the NCLU commands to configure NTP and run the net add time ntp source <interface> command before you run the net add time ntp server <server> iburst command, the /etc/ntp.conf file is misconfigured.To work around this issue, run the net add time ntp server <server> iburst command before you run the net add time ntp source <interface> command. | 3.7.10-3.7.11 |
| CM-27295 | IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.[ip6tables] | 3.7.2-3.7.11 |
| CM-27120 | When an interface flap occurs, numbered IPv6 BGP sessions might fail to establish. To work around this issue, run the ip -6 route flush cache <IPv6-address> command to flush the IPv6 route cache. | 3.7.9-3.7.11 |
| CM-26894 | The neighmgrd service does not ignore neighbors on reserved devices (lo and management devices). This issue is not seen when management VRF is enabled. | 3.7.8-3.7.11 |
| CM-26839 | On the Dell S5248F-ON switch, CPU core temp sensors may show as ABSENT. | |
| CM-26351 | After you remove a subinterface, the BGP session stays in a Connect state. | 3.7.8-3.7.11 |
| CM-26241 | On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. | 3.7.6-3.7.11 |
| CM-25665 | On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur:
| 3.7.5-3.7.11 |
| CM-22591 | CVE-2018-5391 (FragmentSmack) is a network vulnerability where an attacker can trigger time and calculation expensive fragment reassembly with specially crafted packets, leading to a denial of service. On a Cumulus Linux switch, the impact is limited to control plane and management plane traffic. Any control plane traffic coming in the front panel ports will be limited by existing policer ACLs. To work around this issue, create a file called /etc/sysctl.d/ip.conf and add these settings:net.ipv4.ipfrag_low_thresh = 196608 | 3.7.0-3.7.11 |
3.7.11 Release Notes
Open issues in 3.7.11
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-29740 | The exim4 package available for optional installation on Cumulus Linux 3.x has the following vulnerability:DLA-2213-1 / CVE-2020-12783: Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. The spa authentication driver is not enabled by default. Vulnerable: <= 4.84.2-2+deb8u6 Fixed: 4.84.2-2+deb8u7 | 3.0.0-3.7.12 | |
| CM-29556 | CVE-2020-11868: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp. This affects: ntp-4.2.8p12 (possibly earlier) and ntp-4.2.8p13 The fix for https://bugs.ntp.org/3445 introduced a bug whereby a system that is running ntp-4.2.8p12 or p13 that only has one unauthenticated time source can be attacked in a way that causes the victim’s next poll to its source to be delayed, for as long as the attack is maintained. http://support.ntp.org/bin/view/Main/NtpBug3592 gives the following mitigations if it is not possible to upgrade to a version with the fix:
| 3.0.0-3.7.12 | |
| CM-29525 | The asic-monitor.service fails when you configure /etc/cumulus/datapath/monitor.conf with monitor.histogram_pg.collect.port_group_list = <span class="error">[all_packet_pg]</span> and there is traffic passing through the buffer. When the service fails, you see the following traceback in journalctl:asic-monitor[7389]: asic-monitor-module INFO: 2020-05-01 18:28:12.548734: Egress queue(s) greater than 500 bytes in monitor port group histogram_pg | 3.7.11-3.7.12 | |
| CM-29518 | The following vulnerability affects the ruby2.1 package, which is installed by default: CVE-2020-10663: The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.1 has an unsafe object creation vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. Vulnerable: 2.1.5-2+deb8u9 Fixed: 2.1.5-2+deb8u10 | 3.0.0-3.7.12 | |
| CM-29484 | The following vulnerability affects libgd2/libgd3: CVE-2018-14553: gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled). Vulnerable: <= 2.1.0-5+deb8u13 Fixed: 2.1.0-5+deb8u14 | 3.0.0-3.7.12 | |
| CM-29483 | The following vulnerability affects imptool: CVE-2020-5208: It’s been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. Vulnerable: <= 1.8.14-4 Fixed: 1.8.14-4+deb8u1 | 3.0.0-3.7.12 | |
| CM-29367 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-3.7.12 | |
| CM-29309 | When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. | 3.7.11-3.7.12 | |
| CM-29284 | The following vulnerabilities affect git, which is available in the repository for optional installation: CVE-2020-5260: Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. CVE-2020-11008: Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. | 3.0.0-3.7.12 | |
| CM-29208 | The following vulnerability has been announced in ceph; the associated libraries librados2 and librbd1 are available in the Cumulus Linux 3 repository for optional installation. CVE-2020-1760: It was discovered that there was a header-splitting vulnerability in ceph, a distributed storage and file system. Vulnerable: <= 0.80.7-2+deb8u2 Fixed: 0.80.7-2+deb8u4 | 3.0.0-3.7.12 | |
| CM-29068 | On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-3.7.12 | |
| CM-29048 | The following vulnerability exists in the ruby2.1 package: CVE-2016-2338: An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer “head” allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow Vulnerable: <= 2.1.5-2+deb8u8 Fixed: 2.1.5-2+deb8u9 | 3.0.0-3.7.12 | |
| CM-29044 | A large number of flapping peers causes FRR to require a corresponding update to internal data structures that track peer information. Updating this internal data structure does not delete links that are down due to the flapping. The size of this array then grows to contain both current peers as well as peers that should have been deleted during the flap processing. The contents of this array is processed by FRR to poll the links, which consumes CPU for all items in the array. This additional polling consumes more CPU than necessary but has no functional impact. To work around this issue, restart FRR. | 3.7.11-3.7.12 | |
| CM-29040 | The following issue has been found in e2fsprogs, a package that contains ext2/ext3/ext4 file system utilities:CVE-2019-5188: A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. | 3.0.0-3.7.12 | |
| CM-28995 | After you flap an MLAG peerlink, a rare condition might occur where routes and neighbors for VXLAN-enabled VLANs are misprogrammed as non-VXLAN routes and neighbors due to VNI state transitions. This results in a forwarding failure for traffic destined to these misprogrammed routes and neighbors. Note: Do not flap a VNI interface manually. The only expected time for a VNI interface to go down is when the MLAG secondary switch brings the VNIs protodown during a peer link failure where the backup IP address is still active. To recover from this condition, restart switchd with the sudo systemctl restart switchd command. | 3.7.10-3.7.12 | |
| CM-28993 | The following security vulnerability has been announced that affects the libicu52 package: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. Vulnerable: <= 52.1-8+deb8u7 Fixed: 52.1-8+deb8u8 | 3.0.0-3.7.12 | |
| CM-28992 | The following security vulnerability has been announced: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. | 3.0.0-3.7.12 | |
| CM-28954 | The python-twisted-* packages, which are available for optional installation in Cumulus Linux but are not installed by default, were found to have the following security vulnerabilities: CVE-2020-10808: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request. CVE-2020-10809: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request. | 3.0.0-3.7.12 | |
| CM-28944 | A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted. To work around this issue, reenter the redistribute <connected\|static> route-map <route-map-name> statement in the configuration. | 3.6.2-3.7.12 | |
| CM-28938 | When you install an ACL LOG/DROP rule on a layer 3 ingress interface that is a member of a VRF, traffic that matches this rule is not logged and is still forwarded. To work around this issue, apply the ACL LOG/DROP rule to the VRF device itself or to the layer 2 VNI. | 3.7.6-3.7.12 | |
| CM-28867 | The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12 | |
| CM-28816 | The following security advisory has been announced for bash: CVE-2019-18276 Qualys scan QID 372268 setuid vulnerability When bash or bash scripts are run setuid, bash is supposed to drop privileges, but does so incorrectly, so that an attacker with command access to the shell can use enable -f for runtime loading of a new builtin that calls setuid() to regain dropped privileges.To work around this issue, do not make bash or bash scripts setuid. | 3.0.0-3.7.12 | |
| CM-28811 | The following security vulnerability affects the libvpx1 library:CVE-2020-0034: It was discovered that there was an out-of-bounds buffer read vulnerability in libvpx, a library implementing the VP8 & VP9 videocodecs. | 3.0.0-3.7.12 | |
| CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.12 | |
| CM-28655 | When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.6.1-3.7.12 | |
| CM-28533 | On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-3.7.12 | |
| CM-28488 | The following CVEs were announced that affect the cron package. All of these require untrusted local user access.CVE-2017-9525 is a local user privilege escalation attack: In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs. CVE-2019-9704, CVE-2019-9705, CVE-2019-9706 are local user denial of service attacks. Note: the fix for CVE-2019-9705 imposes a limitation on the length of a crontab file (the vulnerability was that an unlimited size crontab file could cause excessive memory consumption). https://security-tracker.debian.org/tracker/DLA-1723-1 | 3.0.0-3.7.12 | |
| CM-28487 | The following CVE was announced for rsyslog: CVE-2019-17041 CVE-2019-17042 rsyslogd, when receiving remote log messages and using optional pmaixforwardedfrom or pmcisconames parser modules (not enabled by default on Cumulus Linux), is vulnerable to CVE-2019-17041 and CVE-2019-17042 where malicious messages that appear to be from AIX or Cisco respectively may be caused to skip sanity checks, resulting in incorrect negative lengths causing heap overflows.Do not enable (with $UDPServerRun or $InputTCPServerRun) receiving syslog messages from other hosts by the network. Also, do not enable (with $ModLoad) the vulnerable parsers pmaixforwardedfrom or pmcisconames.<br/>The default /etc/rsyslog.conf file on Cumulus Linux does NOT enable $UDPServerRun or $InputTCPServerRun, so the vulnerability is not network exploitable in the default configuration. In addition, the vulnerable parsers are not enabled in the default configuration. | 3.0.0-3.7.12 | |
| CM-28486 | The following vulnerability has been found in the libgcrypt20 cryptographic library. CVE-2019-13627: there was a ECDSA timing attack. For more information, see https://www.debian.org/lts/security/2020/dla-1931-2.en.html Vulnerable: 1.6.3-2+deb8u7 Fixed: 1.6.3-2+deb8u8 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28485 | The following vulnerability affects libxml2: CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c has a memory leak related to newDoc->oldNs. This can lead to a denial of service. For more information, see https://www.debian.org/lts/security/2019/dla-2048.en.html . Vulnerable: 2.9.1+dfsg1-5+deb8u7 Fixed: 2.9.1+dfsg1-5+deb8u8 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28484 | The following vulnerability affects libbsd, a package containing utility functions from BSD systems. CVE-2016-2090: In function fgetwln() an off-by-one error could triggers a heap buffer overflow. For more information, see https://www.debian.org/lts/security/2019/dla-2052.en.html . Vulnerable: 0.7.0-2 Fixed: 0.7.0-2+deb8u1 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28465 | When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. | 3.7.11-3.7.12 | |
| CM-28462 | On rare occasions, when you upgrade Cumulus Linux with the apt-get upgrade command, the upgrade fails and reports No space left on device. Checking the disk utilization shows that the disk is not full.To work around this issue, run the apt-get upgrade command again and reboot the device if prompted to complete the upgrade. | 3.7.10-3.7.12 | |
| CM-28451 | An error similar to the following shows in syslog for Mellanox switches:2020-02-12T19:59:22.208012+08:00 leaf01 sx_sdk: RM_TABLE: No resources available to add 1 entries to KVD hash Table HW resource To work around this issue, reboot the switch. | 3.7.11-3.7.12 | |
| CM-28442 | PTM mis-detects incorrect hostnames of LLDP neighbors and does not fail them as expected. Instead they end up in an N/A cabling status. | 3.7.11-3.7.12 | |
| CM-28441 | If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. | 3.7.11-3.7.12 | |
| CM-28393 | On the Dell S5232F-ON switch, EVPN and dynamic VRF route leaking results in the CPU forwarding traffic to newly-learned type-2 routes. To work around this issue, restart FRR. | 3.7.9-3.7.12 | |
| CM-28376 | On the Dell S5232F-ON switch, the output of ledmgrd shows amber_blinking but smonctl shows all OK. | 3.7.11-3.7.12 | |
| CM-28374 | When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-3.7.12 | |
| CM-28372 | On the EdgeCore AS7326-56X switch, the default fan speed, which is defined in the thermal specification, results in excessive fan noise. | 3.7.11-3.7.12 | |
| CM-28371 | On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-3.7.12 | |
| CM-28340 | Mellanox switches with the Spectrum A0 ASIC that are integrated with VMware NSX experience BFD connectivity issues with service nodes. As a result, VXLAN tunnels do not work. Mellanox switches with the Spectrum A1 ASIC do not have this issue. | 3.7.11-3.7.12 | |
| CM-28331 | When you add a route map to advertise IPv4 unicast in a BGP EVPN configuration and the route map contains a set operation, BGP crashes. | 3.7.11-3.7.12 | |
| CM-28313 | On the EdgeCore Wedge100 and Facebook Wedge-100S switch, certain physical ports are not correctly mapped to the logical ones. For example: Logical swp39 controls physical swp41 Logical swp40 controls physical swp42 Logical swp43 controls physical swp45 Logical swp44 controls physical swp46 This might causes incorrect forwarding behavior. | 3.7.11 | 3.7.12 |
| CM-28276 | When a Trident3 switch receives packets containing an IP checksum value that is not compliant with RFC 1624, the TTL is decremented after a routing operation but the checksum is not recalculated. This results in the IP checksum value being invalid as the packet leaves the switch. | 3.7.10-3.7.11 | 3.7.12 |
| CM-28223 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-1711: block: iscsi: OOB heap access via an unexpected response of iSCSI Server | 3.0.0-3.7.12 | |
| CM-28222 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-7039: tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code. Vulnerable: <= 2.1+dfsg-12+deb8u12 Fixed: 2.1+dfsg-12+deb8u13 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28219 | The following vulnerability affects sudo, which is installed by default on Cumulus Linux. It is potentially exploitable on Cumulus Linux if pwfeedback (which is NOT enabled by default) is enabled in the /etc/sudoers file. CVE-2019-18634: In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c. For more information, refer to: https://security-tracker.debian.org/tracker/source-package/sudo https://security-tracker.debian.org/tracker/CVE-2019-18634 https://www.sudo.ws/alerts/pwfeedback.html Vulnerable: <= 1.8.10p3-1+deb8u6 Fixed: 1.8.10p3-1+deb8u7 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28212 | The hsflowd service sends an undefined header protocol 0 in the sampled flow sample to the collector, which is not recognized by the sFlow tool. You see errors similar to the following:Dec 20 08:43:27 netflow-nms sfcapd[3991]: SFLOW: readFlowSample_header() undefined headerProtocol = 0 | 3.7.11-3.7.12 | |
| CM-28169 | On the Dell Z9264F-ON switch, the CPU core temperature sensors report ABSENT. | 3.7.11 | 3.7.12 |
| CM-28160 | On the Broadcom Trident3 switch with DHCP relay, where the DHCP server is reachable through the EVPN overlay, DHCP discover packets forwarded to the CPU might appear corrupt and might not get forwarded. | 3.7.9-3.7.12 | |
| CM-28136 | The MLAG switch pair has VLANs defined that are not used on MLAG bonds. These VLANs still synchronize MAC addresses across to the peer switch. This results in log messages that indicate a MAC address is installed and the VLAN is not defined; for example:RTM_NEWNEIGH with unconfigured vlan XXXX on port peerlink | 3.7.10-3.7.12 | |
| CM-28091 | Two security issues were found in the Python interface to the apt package manager, which is installed by default on Cumulus Linux; package downloads from unsigned repositories were incorrectly rejected (CVE-2019-15796) and the hash validation relied on MD5 (CVE-2019-15795). For more information, refer to https://security-tracker.debian.org/tracker/source-package/python-apt Vulnerable: 0.9.3.12 Fixed: 0.9.3.13 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28087 | The last eight ports of the EdgeCore AS4610-54P switch (swp41 through swp48) do not power UPOE access points. | 3.7.11 | 3.7.12 |
| CM-28086 | The ospfd daemon might crash with the following kernel trace:2019-11-06T23:00:08.261749+09:00 cumulus ospfd[5339]: Assertion ‘node’ failed in file ospfd/ospf_packet.c, line 671, function ospf_write | 3.7.11-3.7.12 | |
| CM-28080 | TACACS+ through ClearPass is not currently supported. Cumulus Linux sends authorization before authentication, but ClearPass does not accept an authorization before the user is authenticated. | 3.7.11-3.7.12 | |
| CM-28078 | On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-3.7.12 | |
| CM-28077 | An unhandled exception might occur after you run the sudo poectl -i command. In addition, random poed daemon restarts can occur without any unhandled exceptions but with an invalid response length error. Both issues can occur due to a SerialException.To work around this issue, power cycle the switch. A software reboot does not resolve the issue. | 3.7.10-3.7.11 | 3.7.12 |
| CM-28076 | After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom --init command. | 3.6.0-3.7.12 | |
| CM-28065 | Editing the outbound route-map of a BGP peer causes all received prefixes by that BGP peer to reset and reinstall. This might cause a brief impact to traffic for those prefixes. | 3.7.11 | 3.7.12 |
| CM-28061 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-3.7.12 | |
| CM-28048 | On the Lenovo NE2580 switch, the fan speeds are higher than expected within normal operating conditions. | 3.7.11 | 3.7.12 |
| CM-28038 | After you convert a bond back to a layer 2 access port, ifupdown2 changes all SVI MTUs to 1500. To work around this issue, run ifreload -a a second time. | 3.7.11 | 3.7.12 |
| CM-28016 | On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. | 3.7.7-3.7.11 | 3.7.12 |
| CM-28007 | When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 | 3.7.12 |
| CM-28003 | The FRR service does not provide a way for automation to know if the configuration applied properly. To work around this issue, execute the vtysh -f <file> command in the automation file before starting the FRR service to validate the functional configuration and return an error code. | 3.7.11-3.7.12 | |
| CM-27999 | On the EdgeCore AS7326-56X switch, the PSU fans show constant LOW warnings. | 3.7.10-3.7.12 | |
| CM-27982 | On Broadcom switches, switchd crashes when dynamic VRF route leaking is enabled and the following is true:
| 3.7.10-3.7.12 | |
| CM-27957 | If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:bq. systemd[1]: switchd.service watchdog timeout (limit 2min)! To workaround this issue, either reduce the number of configured interfaces and/or VLANs or increase the systemd timeout for switchd.service.To increase the systemd timeout:
| 3.7.11-3.7.12 | |
| CM-27947 | Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. | 3.7.0-3.7.11 | 3.7.12 |
| CM-27937 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 One of the listed vulnerabilities is still present in the latest upstream version 2.1+dfsg-12+deb8u12 (the others have been fixed): CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. https://security-tracker.debian.org/tracker/CVE-2017-15124 | 3.0.0-3.7.12 | |
| CM-27927 | On the Delta AG6248C switch, the NCLU net show system sensors command shows an error:Could not collect output from command: ['/usr/sbin/smonctl’] To work around this issue, run the net show system sensors json command instead. | 3.7.11 | 3.7.12 |
| CM-27924 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.26.dfsg1-13+deb8u1 Fixed: 2.1.26.dfsg1-13+deb8u2 | 3.0.0-3.7.11 | 3.7.12 |
| CM-27855 | The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. | 3.7.0-3.7.11 | 3.7.12 |
| CM-27814 | A traditional bridge with QinQ and a VNI does not work for tagged traffic. | 3.7.10-3.7.12 | |
| CM-27804 | You might see a switchd memory leak during ECMP group expansion or consolidation. | 3.7.10-3.7.11 | 3.7.12 |
| CM-27793 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.27+dfsg-1 Fixed: 2.1.27+dfsg-1+deb10u1 | 3.0.0-3.7.12 | |
| CM-27764 | On the EdgeCore AS7326-56X switch, eth0 and swp1 use the same MAC address. | 3.7.9-3.7.11 | 3.7.12 |
| CM-27737 | On the EdgeCore AS7326-56X switch, you might see the RPM of certain fans run over the maximum threshold. | 3.7.11 | 3.7.12 |
| CM-27698 | SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.12 | |
| CM-27683 | The following CVEs were announced that affect the Linux kernel: CVE-2019-12378: An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-12381: An issue was discovered in ip_ra_control in net/ipv4/ip_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-15239: In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation. CVE-2019-19062: A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042. CVE-2019-19537: In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID-303911cfc5b9. This affects drivers/usb/core/file.c. CVE-2019-20054: In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e. | 3.0.0-3.7.11 | 3.7.12 |
| CM-27670 | A memory leak in switchd might occur, which causes switchd to restart. | 3.7.10-3.7.11 | 3.7.12 |
| CM-27646 | Several vulnerabilities have been discovered in Git, a fast, scalable, distributed revision control system, which is available in the Cumulus Linux 3.x repositories for optional installation. CVE-2019-1348: export-marks is insecure, fix is to disable by default. CVE-2019-1349: .git / git~1 filename vulnerability on NTFS CVE-2019-1352: .git vulnerability with NTFS Alternate Streams Accesses CVE-2019-1353: NTFS filesystem protection should be on by default CVE-2019-1387: dubiously-nested submodule git directories should be disallowed CVE-2019-19604: submodule update repository code execution vulnerability Vulnerable: <= 2.1.4-2.1+deb8u7 Fixed: 2.1.4-2.1+deb8u8 | 3.0.0-3.7.12 | |
| CM-27644 | Ifupdown2 does not set up the front panel interface for the dhclient to accept the DHCP OFFER.To work around this issue, restart the networking service after ifreload -a with the systemctl restart networking command. | 3.7.10-3.7.11 | 3.7.12 |
| CM-27620 | When using QinQ with a traditional bridge, if you enable the LLDP dot1 TLV option, you see the following suboptimal behavior:
| 3.7.11-3.7.12 | |
| CM-27586 | CPU usage might be higher than normal if you have a high number of interfaces x VLANs and lldpd is active. This issue is introduced with code changes in Cumulus Linux 3.7.11, where VLAN information is now available for LLDP to advertise to neighbors (https://docs.cumulusnetworks.com/version/cumulus-linux-37/Layer-2/Link-Layer-Discovery-Protocol/#vlan-dot1-tlv). You might see high CPU usage even if VLAN (dot1) TLV configuration is disabled.To check if lldpd is the heavy CPU resource user, run the following command:cumulus@switch:~$ ps -eo user,pid,ppid,cmd,%mem,%cpu –sort=-%cpu | head Alternatively, check for messages in the /var/log/syslog directory similar to:2020-02-20T15:02:12.137857-05:00 leaf01 sysmonitor: High CPU use: 87% Note: The exact amount of CPU usage varies in each network based on a number of factors; however, it is unusual for lldpd to consume more than 30% CPU for an extended period of time.To work around this issue, you can do one of the following:
| 3.7.11-3.7.12 | |
| CM-27581 | On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel.To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.This workaround only works when an out-of-band network is present. | 3.7.11-3.7.12 | |
| CM-27530 | When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. | 3.7.10-3.7.12 | |
| CM-27525 | On the Delta AG6248C PoE switch, if the PoE priority is set to low on some ports, other ports with a higher priority might have their requests to draw power rejected instead of the lower priority ports being brought down. | 3.7.11 | 3.7.12 |
| CM-27522 | The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. | 3.7.10-3.7.12 | |
| CM-27507 | The ports.conf file on the Dell S5248F-ON switch does not show port ganging or breakout options. | 3.7.10-3.7.11 | 3.7.12 |
| CM-27496 | All Broadcom Trident3 X7 switches contain PCIE firmware, which is programmed by the vendor when the switch is manufactured. The latest version of this firmware (2.6) is incompatible with Cumulus Linux 3.7.11 and earlier, and Cumulus Linux 4.0. To work around this issue, downgrade the Broadcom ASIC firmware to an earlier version. | 3.7.11 | 3.7.12 |
| CM-27444 | If you use the NCLU commands to configure NTP and run the net add time ntp source <interface> command before you run the net add time ntp server <server> iburst command, the /etc/ntp.conf file is misconfigured.To work around this issue, run the net add time ntp server <server> iburst command before you run the net add time ntp source <interface> command. | 3.7.10-3.7.11 | 3.7.12 |
| CM-27354 | On the Celestica Pebble switch, if you use IPv6 routes with mask /65 to /127, the switchd log fills with errors. | 3.7.10-3.7.12 | |
| CM-27295 | IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.[ip6tables] | 3.7.2-3.7.11 | 3.7.12 |
| CM-27279 | When ECMP routes have both VXLAN (symmetric routing) and non-VXLAN paths, the non-VXLAN path is incorrectly installed in the RIB and FIB to point across VXLAN. The non-VXLAN next-hop will be installed as an offload entry in the neighbor table (ip neigh show) with a mac address of 00:00:00:00:00:00. | 3.7.3-3.7.12 | |
| CM-27192 | If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. | 3.7.10-3.7.12 | |
| CM-27173 | On the Trident3 switch, unicast ARP packets received on a VNI and forwarded to the CPU are not policed. | 3.7.10-3.7.12 | |
| CM-27120 | When an interface flap occurs, numbered IPv6 BGP sessions might fail to establish. To work around this issue, run the ip -6 route flush cache <IPv6-address> command to flush the IPv6 route cache. | 3.7.9-3.7.11 | 3.7.12 |
| CM-27094 | On the Delta AG9032v1 switch, smonctl and sensors report inaccurate PSU current and power. | 3.5.0-3.7.12 | |
| CM-27018 | If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.12 | |
| CM-26921 | If you delete an undefined bond, then add a bond slave, the net commit command fails. | 3.7.9-3.7.12 | |
| CM-26913 | FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:sudo sh -c “printf ‘interface 50\nvrf TEST description L3 routing interface\n’ » /etc/frr/frr.conf" should be: sudo sh -c “printf ‘interface 50 vrf TEST\ndescription L3 routing interface\n’ » /etc/frr/frr.conf" To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. | 3.7.9-3.7.12 | |
| CM-26905 | When you update the hostname of a switch with the NCLU net add hostname <hostname> command, then run net commit, the lldpd service does not restart and other devices still see the old name.To work around this issue, run the sudo systemctl restart lldpd.service command. | 3.7.10-3.7.12 | |
| CM-26894 | The neighmgrd service does not ignore neighbors on reserved devices (lo and management devices). This issue is not seen when management VRF is enabled. | 3.7.8-3.7.11 | 3.7.12 |
| CM-26875 | After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. | 3.7.9-3.7.12 | |
| CM-26655 | If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:net add time ntp server 1.2.3.4 iburst If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. | 3.7.9-3.7.12 | |
| CM-26599 | Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. | 3.7.9-3.7.12 | |
| CM-26595 | The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. | 3.7.9-3.7.12 | |
| CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.12 | |
| CM-26463 | The following CVEs affect the linux kernel package: CVE-2019-14821 CVE-2019-14835 CVE-2019-15117 CVE-2019-15118 CVE-2019-15902 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.7.10-3.7.12 | |
| CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.12 | |
| CM-26412 | Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. | 3.7.9-3.7.12 | |
| CM-26351 | After you remove a subinterface, the BGP session stays in a Connect state. | 3.7.8-3.7.11 | 3.7.12 |
| CM-26288 | On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.12 | |
| CM-26256 | The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. | 3.7.8-3.7.12 | |
| CM-26241 | On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. | 3.7.6-3.7.11 | 3.7.12 |
| CM-26230 | When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. | 3.7.8-3.7.12 | |
| CM-26225 | On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:2019-09-05T05:15:17.246597+00:00 hp-6712-03 decode-syseeprom: Unable to find eeprom at /sys/bus/i2c/devices/11-0050/eeprom for psu2 | 3.7.9-3.7.12 | |
| CM-26139 | Selective ERSPAN does not work when you specify a bridge port. | 3.7.6-3.7.12 | |
| CM-26138 | You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:-A FORWARD -i swp5 -s 00:25:90:b2:bd:9d -d 50:6b:4b:96:c4:04 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64 | 3.7.6-3.7.12 | |
| CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:-A FORWARD -i vni10 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64 | 3.7.6-3.7.12 | |
| CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.12 | |
| CM-26126 | Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.12 | |
| CM-26024 | On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. | 3.7.7-3.7.12 | |
| CM-25923 | The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. | 3.7.8-3.7.12 | |
| CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.12 | |
| CM-25859 | The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. | 3.7.7-3.7.12 | |
| CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.12 | |
| CM-25796 | Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:ifdown vlan123 ; sleep 2 ; ifup vlan123 You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. | 3.7.5-3.7.12 | |
| CM-25794 | Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.12 | |
| CM-25766 | On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. | 3.7.7-3.7.12 | |
| CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:cumulus@switch:~$ net add bridge mybridge vlan-protocol 802.1ad | 3.7.6-3.7.12 | |
| CM-25694 | If a packet is policed by ebtables, it does not increment an ACL drop on the ingress interface. Instead, it increments the TDBGC3/6 drop counter to the CPU. | 3.7.6-3.7.12 | |
| CM-25665 | On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur:
| 3.7.5-3.7.11 | 3.7.12 |
| CM-25641 | If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl.To work around this issue, power cycle the switch. | 3.7.6-3.7.12 | |
| CM-25404 | hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. | 3.7.6-3.7.12 | |
| CM-25400 | If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. | 3.7.6-3.7.12 | |
| CM-25397 | When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. | 3.7.3-3.7.12 | |
| CM-25001 | The following CVEs were announced in Debian Security Advisory DSA-444-1, DSA-4447-1 and affect the linux kernel and microcode. Package: linux CVE ID: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 Multiple researchers have discovered vulnerabilities in the way the Intel processor designs have implemented speculative forwarding of data filled into temporary microarchitectural structures (buffers). This flaw could allow an attacker controlling an unprivileged process to read sensitive information, including from the kernel and all other processes running on the system or cross guest/host boundaries to read host memory. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details. To fully resolve these vulnerabilities it is also necessary to install updated CPU microcode. Contact your hardware ndor for microcode uppdates. In addition, this update includes a fix for a regression causing deadlocks inside the loopback driver. Fixed in version 4.19.76-1+cl4u1 | 3.0.0-3.7.12 | |
| CM-24894 | The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. | 3.7.5-3.7.12 | |
| CM-24803 | On the Dell N3048EP-ON or the Delta AG6248 switch, when you execute the following command, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The Cumulus Linux image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new Cumulus Linux image.The workaround only works when an out-of-band network is present. | 3.7.6-3.7.12 | |
| CM-24799 | On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. | 3.7.5-3.7.12 | |
| CM-24751 | On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. | 3.7.3-3.7.12 | |
| CM-24703 | The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.12 | |
| CM-24686 | On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. | 3.7.3-3.7.12 | |
| CM-24652 | In an EVPN environment, the centralized MAC address is not installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN. This issue does not affect a pure distributed routing (symmetric or asymmetric) environment or a pure centralized routing environment. | 3.7.0-3.7.12 | |
| CM-24618 | If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:ERROR: No closing quotation See /var/log/netd.log for more details. | 3.6.1-3.7.12 | |
| CM-24473 | SNMP incorrectly requires engine ID specification. | 3.7.4-3.7.12 | |
| CM-24435 | When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect: net add routing route-map Proxy-ARP permit 25 match interface swp9-10 These commands are correct: net add routing route-map Proxy-ARP permit 25 match interface swp9 net add routing route-map Proxy-ARP permit 30 match interface swp10 | 3.7.2-3.7.12 | |
| CM-24426 | NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf <name> command just displays
Tab completion for the net add vrf <name> ip address <address> command works correctly. | 3.7.4-3.7.12 | |
| CM-24379 | On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.12 | |
| CM-24343 | The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. | 3.7.4-3.7.12 | |
| CM-24332 | On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. | 3.7.3-3.7.12 | |
| CM-24272 | When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface br0.100 switch(config-if)# vrrp 1 priority 110 switch(config-if)# vrrp 1 advertisement-interval switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24271 | On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface vlan100 switch(config-if)# vrrp 1 priority 110 switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24270 | Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface swp4 switch(config-if)# vrrp 1 version 2 switch(config-if)# no vrrp 1 preempt switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24262 | NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto <iface> lines exist. | 3.7.3-3.7.12 | |
| CM-24241 | When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:cumulus@switch:~$ net del bgp neighbor fabric peer-group ‘router bgp 65001’ configuration does not have ‘neighbor fabric peer-group’ | 3.7.2-3.7.12 | |
| CM-24222 | When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. | 3.7.0-3.7.12 | |
| CM-24035 | On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. | 3.7.2-3.7.12 | |
| CM-23825 | The net add interface <interface> ptm-enable command adds no ptm-enable for that interface in the frr.conf file.Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. | 3.7.2-3.7.12 | |
| CM-23792 | When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table.To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev <interface> command. | 3.7.0-3.7.12 | |
| CM-23696 | IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. | 3.7.2-3.7.12 | |
| CM-23665 | NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan <layer3-vni> bridge access <vlan>. This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.To restore connectivity, remove the VLAN ID from the bridge. | 3.7.2-3.7.12 | |
| CM-23661 | On the Mellanox switch, when you configure a GRE tunnel, the traffic behind the local tunnel endpoint destined through the GRE tunnel is software-forwarded. | 3.7.2-3.7.12 | |
| CM-23651 | In an EVPN symmetric routing configuration, when an IP address is frozen, kernel neighbor table information and kernel VRF routing table information about the frozen IP address might be out-of-sync. | 3.7.3-3.7.12 | |
| CM-23584 | When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. | 3.7.2-3.7.12 | |
| CM-23570 | On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. | 3.7.2-3.7.12 | |
| CM-23422 | portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. | 3.7.0-3.7.12 | |
| CM-23418 | For QSFP modules, the sudo ifdown command does not disable the Tx laser. | 3.7.2-3.7.12 | |
| CM-23417 | If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. | 3.7.0-3.7.12 | |
| CM-23397 | On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. | 3.6.2-3.7.12 | |
| CM-23125 | The OpenSSL package on Cumulus Linux 3.x has a vulnerability similar to CVE-2018-0734. (The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key). According to Debian upstream, this version “is not vulnerable [to CVE-2018-0734 exactly]. Nevertheless, there is a bug fix that futher reduces the amount of leaked timing information. It got no CVE on its own and introduced this vulnerability.“ Vulnerable on CL3: 1.0.1t-1+deb8u12 | 3.0.0-3.7.12 | |
| CM-23123 | When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. | 3.7.2-3.7.12 | |
| CM-23075 | There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:2018-11-10T23:35:30.992370-08:00 Dev dhcrelay: Listening on LPF/vlan.101/a0:00:00:00:00:51 2018-11-10T23:35:30.993472-08:00 Dev dhcrelay: Sending on LPF/vlan.101/a0:00:00:00:00:51 Eventually the dhcrelay service stops. | 3.7.1-3.7.12 | |
| CM-23021 | When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. | 3.7.1-3.7.12 | |
| CM-23004 | The local fallback account authenticates using the local password when the RADIUS or TACACS service is up. The expected behavior is for this to fail and only succeed when the RADIUS OR TACACS server fails to respond. | 3.7.1-3.7.12 | |
| CM-22937 | NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation.To work around this issue, stop snmpd, remove the cache file, then restart snmpd. | 3.6.0-3.7.12 | |
| CM-22849 | When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur.This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. | 3.7.2-3.7.12 | |
| CM-22808 | When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. | 3.5.2-3.7.12 | |
| CM-22794 | The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. | 3.6.2-3.7.12 | |
| CM-22591 | CVE-2018-5391 (FragmentSmack) is a network vulnerability where an attacker can trigger time and calculation expensive fragment reassembly with specially crafted packets, leading to a denial of service. On a Cumulus Linux switch, the impact is limited to control plane and management plane traffic. Any control plane traffic coming in the front panel ports will be limited by existing policer ACLs. To work around this issue, create a file called /etc/sysctl.d/ip.conf and add these settings:net.ipv4.ipfrag_low_thresh = 196608 | 3.7.0-3.7.11 | 3.7.12 |
| CM-22583 | Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. | 3.6.0-3.7.12 | |
| CM-22554 | If you try to bring down several members of a bond remotely at the same time, the link state of one of the interfaces might not transition correctly to the down state; however, all links show down in hardware. | 3.6.2-3.7.12 | |
| CM-22386 | The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. | 3.7.0-3.7.12 | |
| CM-22301 | For an unresolved address, the IPROUTER default policer rule has been modified to not match on packets exiting a TUNNEL and headed to the CPU to resolve the address via ARP. As a result, the following default rule no longer matches TUNNEL ingress packets.A $INGRESS_CHAIN –in-interface $INGRESS_INTF -m addrtype –dst-type IPROUTER -j POLICE –set-mode pkt –set-rate 400 –set-burst 100 These packets are now policed by catch all rules. To work around this issue, the VPORT value on a TRIDENT switch must be changed from binary 011 to 100. | 3.6.1-3.7.12 | |
| CM-22287 | On the EdgeCore AS7712 (Tomahawk) switch running in atomic mode, when a layer 3 ECMP path is brought down, traffic traversing the path stops working for about four seconds. When the switch is changed to non-atomic mode, the delay is less than one second. This issue is seen across OSPF and static ECMP routes. | 3.6.2-3.7.12 | |
| CM-22274 | To ease interoperation with non-Cumulus devices, it is possible to configure the route-target import and export values under the layer 2 VNI EVPN configuration. The same configuration does not work for both layer 2 VNI and layer 3 VNIs. Set the EVPN address-family within the VNI context when configuring the route-target in the layer 2 VNI. Set the EVPN address-family without the VNI context when configuring the route-target in the layer 3 VNI. | 3.6.0-3.7.12 | |
| CM-22252 | On the Edgecore OMP-800, there is no Power Supply information from the sensor or from smonctl. The platform driver has support for the PSUs but this was not added to the sensors infrastructure.This is a known limitation on the OMP-800 platform. | 3.6.2-3.7.12 | |
| CM-22228 | On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.12 | |
| CM-22205 | If a user is in vtysh when FRR is restarted, the running configuration in that vtysh session shows empty. | 3.6.2-3.7.12 | |
| CM-22138 | When you run the NCLU net show system command or the NetQ netq inventory command on the Edgecore OMP-800 switch, the output does not show any port or chip information. | 3.6.2-3.7.12 | |
| CM-22041 | At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. | 3.4.3-3.7.12 | |
| CM-22020 | On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. | 3.7.0-3.7.12 | |
| CM-21927 | When running ifreload on Mellanox Spectrum devices, after updating an interface configuration, sometimes VLANs are not programmed into the hardware data plane. The Linux control plane looks normal but the VLAN has not been programmed into the hardware and packets that arrive for the VLAN might be dropped.To work around this issue, remove and re-add the affected VLANs from the port. | 3.5.3-3.7.12 | |
| CM-21898 | On a Trident3 switch, IGMP packets are not policed by the police rule in the 00control ACL file. The packets are policed by the catchall policer in the 99control ACL file instead.-A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police --set-mode pkt --set-rate 100 --set-burst 100To work around this issue, let the CPU bound IGMP packet hit the following rule and change the policer rate to a desired value for IGMP packets: -A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police --set-mode pkt --set-rate 100 --set-burst 100Typically, the destination MAC address 01:00:5e:xx:xx:xx is used only for PIM/IGMP control and data stream packets. However, this workaround cannot handle data stream multicast packets that are not TCP/UDP; this is not typically done. | 3.6.2-3.7.12 | |
| CM-21785 | The source address of the ICMPv6 time exceeded message (traceroute hop) is sourced from the wrong VRF when the traceroute target resides on the same switch but in a different VRF. | 3.6.2-3.7.12 | |
| CM-21769 | On the Mellanox switch, GRE tunneling does not work if the tunnel source is configured on an SVI interface. If the tunnel source is configured on a physical switch port, then tunneling works as expected. | 3.6.1-3.7.12 | |
| CM-21678 | On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty: cumulus@switch:~$ netq show sensors temp changes | grep absent | grep -v psu P2Leaf01 temp9 networking asic die temp sensor absent 43 105 100 5 Unable to find driver path: /cumulu Add 7d:22h:1m:41s P2Leaf01 temp6 networking asic die temp sensor absent 45 105 100 5 Unable to find driver path: /cumulu Add 7d:22h:1m:41s P2Leaf01 temp6 networking asic die temp sensor absent 47 105 100 5 Unable to read temp4_highest Add 9d:23h:26m:6s P2Leaf01 temp6 networking asic die temp sensor absent 45 105 100 5 Unable to read temp4_highest Add 14d:22h:46m:45s This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response. | 3.5.3-3.7.12 | |
| CM-21667 | FRR does not add BGP ttl-security to either the running configuration or to the /etc/frr/frr.conf file when configured on a peer group instead of a specific neighbor.To work around this issue, add ttl-security to individual neighbors instead of the peer group. | 3.6.1-3.7.12 | |
| CM-21379 | If a primary route becomes unavailable (for example, you run ifdown on the switch port), the backup route remains inactive and is not installed into FIB.To work around this issue, configure routes as ECMP: cumulus@switch:~$ net del routing route 4.1.1.0/24 1.1.1.1 10 cumulus@switch:~$ net add routing route 4.1.1.0/24 1.1.1.1 cumulus@switch:~$ net commit | 3.5.3-3.7.12 | |
| CM-21332 | When two VLAN subinterfaces are bridged to each other in a traditional mode bridge, switchd doesn’t assign a gport to the subinterface, even though a gport is expected for each VLAN subinterface.To work around this issue, you can do one of two things:
| 3.5.3-3.7.12 | |
| CM-21058 | The advertised routes list may be empty for an EVPN peering even though the remote switch reports received routes. | 3.6.0-3.7.12 | |
| CM-21055 | On the Mellanox switch, the destination MAC address of ERSPAN GRE packets is set to all zeros; therefore, the first transit switch might drop packets. | 3.6.0-3.7.12 | |
| CM-20813 | Span rules matching the out-interface as a bond do not mirror packets. | 3.6.0-3.7.12 | |
| CM-20693 | In NCLU, you can only set the community number in a route map. You cannot set other community options such as no-export, no-advertise, or additive.This is a known limitation in network-docopt and is documented in the Cumulus Linux user guide. | 3.5.1-3.7.12 | |
| CM-20508 | The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. | 3.5.3-3.7.12 | |
| CM-20480 | The python-crypto package, which is not installed by default on Cumulus Linux, but is present in the repository to be installed, has the following security vulnerability in the version available for Cumulus Linux 3.x: CVE-2018-6594: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto’s ElGamal implementation. More information at https://security-tracker.debian.org/tracker/CVE-2018-6594 . | 3.0.0-3.7.12 | |
| CM-20033 | The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down. | 3.5.2-3.7.12 | |
| CM-19788 | If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict.To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. | 3.5.0-3.7.12 | |
| CM-19724 | PIM and MSDP entries are set to the internal COS value of 6 so they are grouped together with the bulk traffic priority group in the default traffic.conf file. However, PIM, IGMP, and MSDP are considered control-plane and should be set to the internal COS value of 7. | 3.5.2-3.7.12 | |
| CM-19454 | When you use NCLU to bring a bond admin down (net add bond <bond> link down), the bond interface goes into admin down state but the switch ports enslaved to the bond remain UP. If you are using bond-lacp-bypass-allow or balance-xor mode, the host might continue to send traffic. This traffic will be dropped because although the bond slaves are UP, they are not members of the bridge.To work around this issue, use the sudo ifdown <bondname> command. | 3.5.0-3.7.12 | |
| CM-18192 | In FRR, bgp_snmp does not show all BGP peers when peer groups used. | 3.7.11-3.7.12 | |
| CM-17934 | FRR tracks interface speed based on the value it learns from the Linux kernel for that interface. If the interface speed changes, FRR does not update its interface speed cache. This can lead to issues for routing protocols that derive metrics from interface speed as the cost can become out of sync with the interface speed. To work around this issue, manually define the routing protocol metric for these interfaces or restart FRR. | 3.7.6-3.7.12 | |
| CM-17557 | When sFlow is enabled, some sampled packets, such as IPMC, are forwarded twice (in the ASIC and then again through the kernel networking stack). | 3.4.0-3.7.12 | |
| CM-17494 | In certain cases, a peer device sends an ARP request from a source IP address that is not on the connected subnet and the switch creates a STALE neighbor entry. Eventually, the switch attempts to keep the entry fresh and sends ARP requests to the host. If the host responds, the switch has REACHABLE neighbor entries for hosts that are not on the connected subnet. To work around this issue, change the value of arp_ignore to 2. See Default ARP Settings in Cumulus Linux for more information. | 3.3.2-3.7.12 | |
| CM-16855 | If a two nodes on both sides of a link change from auto-negotiation off to auto-negotiation on for both sides during a short interval (around one second), the link might start flapping or stay down.To work around this issue and stop the flapping, turn the link down on the switch with the command ifdown swpX, wait a few seconds, then bring the link back up with the command ifup swpX. Repeat this on the other side if necessary. | 3.3.2-3.7.12 | |
| CM-16571 | NCLU cannot manage rsyslog to addresses routed via a VRF. In Cumulus Linux 4.0.0 and later, management VRF is enabled by default. To work around this issue, update the /etc/network/interfaces file to disable management VRF. | 3.4.3-3.7.12 | |
| CM-16461 | After booting a Cumulus VX virtual machine running the VMware OVA image, sometimes messages from sensors appear, indicating that the “Avg state” is critical, with all values displayed as 100.0. A cl-support is generated. | 3.4.2-3.7.12 | |
| CM-15812 | Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. | 3.2.1-3.7.12 | |
| CM-15601 | On a Mellanox switch in an MLAG environment, a packet from a dually connected host might ingress on one switch but the MAC DA is destined to the router on the peer switch. The packet will traverse the peer link but is not excluded from port isolation (or egress mask) filtering. Similarly, an IP multicast packet might traverse the peer link and need to be routed. | 3.6.2-3.7.12 | |
| CM-15094 | Counter samples for an 80G bond (2 x 40G) exported from the switch show an interface speed (ifSpeed) of 14.464Gbps. | 3.2.0-3.7.12 |
Fixed issues in 3.7.11
| Issue ID | Description | Affects |
|---|---|---|
| CM-28224 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2019-15890: libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. Vulnerable: <= 2.1+dfsg-12+deb8u11 Fixed: 2.1+dfsg-12+deb8u12 | 3.0.0-3.7.10 |
| CM-27628 | The following security vulnerabilities have been announced in the nss/libnss3 library, which is not installed by default but is available in the repository: CVE-2019-11745: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate CVE-2019-17007: nss: Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may crash with a NULL deref leading to DoS See https://security-tracker.debian.org/tracker/source-package/nss for more information. Vulnerable: <= 3.26-1+debu8u7 Fixed: 3.26-1+debu8u9 | 3.0.0-3.7.10 |
| CM-27457 | If you delete, then re-add a PBR policy on an interface, the configured PBR policy is not programmed in the kernel or switchd. | 3.7.9-3.7.10 |
| CM-27456 | After making a series of PBR configuration changes using NCLU commands, the stale PBR entry is still present in the kernel. | 3.7.9-3.7.10 |
| CM-27351 | On rare occasions, after rebooting the MLAG secondary switch, one MLAG device might see the peer as down, which can cause traffic disruption to connected hosts. | 3.7.7-3.7.10 |
| CM-27321 | The following CVEs were announced that affect the ghostscript package: CVE-2019-14869: Manfred Paul and Lukas Schauer reported that the .charkeys procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. Cumulus Linux 3: <= 9.26a~dfsg-0+deb8u5 vulnerable, >= 9.26a~dfsg-0+deb8u6 fixed. https://security-tracker.debian.org/tracker/ghostscript https://security-tracker.debian.org/tracker/CVE-2019-14869 | 3.7.10 |
| CM-27299 | The protocol daemon bgpd crashes when a link/neighbor flaps if static routes pointing to Null0 are advertising through BGP.To work around this issue, reboot the switch, then remove the static routes or stop advertising these routes. | 3.7.9-3.7.10 |
| CM-27269 | The following Linux kernel security vulnerabilities do not affect Cumulus Linux in supported configurations: CVE-2018-12207 CVE-2019-0154 CVE-2019-0155 CVE-2019-11135 Several vulnerabilities have been discovered in the Linux kernel that may may to a privilege escalation, denial of service, or information leak. CVE-2018-12207: Intel CPU hypervisor vulnerability. Running hypervisors on Cumulus Linux is not supported. CVE-2019-0154, CVE-2019-0155: Intel GPU vulnerabilities. GPUs are not present on our switches. CVE-2019-11135, CVE-2019-11139: Intel CPU transactional memory vulnerability. None of our switches support transactional memory. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | |
| CM-27243 | The length of the netlink message is not set properly for non-bridge family type messages. The same length is used for both bridge and non-bridge even though the bridge family type message has an extra attribute. This causes extra bytes to be left over in non-bridge family type netlink messages. | 3.7.10 |
| CM-27233 | If you change multiple BGP or BFD timers in the /etc/frr/frr.conf file and then reload FRR, a traceback is encountered and the change does not take effect. | 3.7.9-3.7.10 |
| CM-27193 | The l1-show command prints a traceback for switch ports that have sub-interfaces configured. There is no functional impact to traffic but the l1-show troubleshooting and validation command does not execute on switch ports that have VLAN sub-interfaces. | 3.7.10 |
| CM-27174 | The ospfd daemon might crash with the following kernel trace:2019-11-06T23:00:08.261749+09:00 cumulus ospfd[5339]: Assertion ‘node’ failed in file ospfd/ospf_packet.c, line 671, function ospf_write | 3.7.6-3.7.10 |
| CM-27096 | On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10 |
| CM-27025 | On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. | 3.7.2-3.7.10 |
| CM-26996 | On the Mellanox switch with the Spectrum ASIC, the --set-burst parameter in an iptables rule does not take effect. | 3.7.10 |
| CM-26968 | When networking fails to start properly, an MLAG memory leak occurs, which might cause memory issues. | 3.7.9-3.7.10 |
| CM-26954 | In the default VRF, VRRP might crash and stay in an initialize state. As a result, VRRP multicast traffic is not generated. | 3.7.8-3.7.10 |
| CM-26947 | The following CVEs affect the OpenLDAP utilities: CVE-2019-13057 CVE-2019-13565 For the detailed security status, refer to the security tracker page at: https://security-tracker.debian.org/tracker/CVE-2019-13565 https://security-tracker.debian.org/tracker/CVE-2019-13057 Vulnerable versions: < 2.4.40+dfsg-1+deb8u5 Fixed versions: >= 2.4.40+dfsg-1+deb8u5 | |
| CM-26838 | You might experience a bgpd memory usage increase and significant update exchanges due to host moves between VTEPs. | 3.7.7-3.7.10 |
| CM-26829 | Frames received with a VLAN tag of 0 on an interface configured as a bridge port and forwarded to the CPU for processing might appear tagged with the native VLAN when viewed with tcpdump. | 3.7.8-3.7.10 |
| CM-26815 | If a router MAC address changes on a VTEP, other VTEPs might still point to the previous router MAC address. | 3.7.10 |
| CM-26769 | Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10 |
| CM-26691 | BGP is configured with soft reconfiguration-in for its peers, which is not working correctly and causes routes to have an unexpected label. As a result, transit traffic is not forwarded by the switch. | 3.7.8-3.7.10 |
| CM-26657 | When you install a large number of new rules with nonatomic mode enabled, there is a chance that you install more rules than the number of available slots in the slice, which results in the slice being completely wiped and reinstalled. This causes a large drop increase, including to cpu0, and might cause a major outage by dropping all BGP sessions. | 3.6.1-3.7.10 |
| CM-26525 | When an MLAG peerlink frequently alternates states between learning and blocking, an excessive number of TCP sessions might be created, which results in the following error display:OSError: [Errno 24] Too many open files | 3.6.2-3.7.10 |
| CM-26523 | Package: hostapd CVE ID: CVE-2019-13377 CVE-2019-16275 Two vulnerabilities were found in the WPA protocol implementation found in wpa_supplication (station) and hostapd (access point). CVE-2019-13377 A timing-based side-channel attack against WPA3’s Dragonfly handshake when using Brainpool curves could be used by an attacker to retrieve the password. CVE-2019-16275 Insufficient source address validation for some received Management frames in hostapd could lead to a denial of service for stations associated to an access point. An attacker in radio range of the access point could inject a specially constructed unauthenticated IEEE 802.11 frame to the access point to cause associated stations to be disconnected and require a reconnection to the network. Fixed version: 1:2.8.0-cl4u3 | 3.7.0-3.7.10 |
| CM-26450 | Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10 |
| CM-26448 | Traffic sent to the SVI IP address of a switch might be lost if all of the following conditions are met:
To workaround this issue, restart switchd. | 3.7.9-3.7.10 |
| CM-26437 | NCLU crashes when you run the net add interface storage-optimized pfc command because non-ascii quotes exist in the datapath.conf file.To work around this issue, manually edit the /usr/lib/python2.7/dist-packages/cumulus/__chip_config/mlx/datapath.conf file and replace the non-ascii single quotes with ascii single quotes (standard single quote on the keyboard). | 3.7.9-3.7.10 |
| CM-26372 | FRR crashes when adding an IPv6 neighbor with extended-nexthop capability. | 3.7.9-3.7.10 |
| CM-26308 | An interface alias configured outside FRR using iproute2 is imported into the FRR running configuration and overrides the internal description. After an FRR reload, this causes FRR to delete the interface alias in an inefficient way. Depending on how many interfaces with aliases you have configured, this can cause a FRR reload to time out.To work around this issue, remove the interface alias description from iproute2. | 3.7.8-3.7.10 |
| CM-26272 | On the Mellanox Spectrum switch, a route withdrawal might cause the associated next hop neighbor entry to be deleted in hardware but remain in the kernel. This can cause traffic going through the directly connected route to the removed neighbor entry to be forwarded to the CPU. | 3.7.6-3.7.10 |
| CM-26255 | On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. | 3.7.6-3.7.10 |
| CM-26252 | The following CVEs were announced that affect the ghostscript package: CVE ID : CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817 It was discovered that various procedures in Ghostscript, the GPL PostScript/PDF interpreter, do not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.7.0-3.7.10 |
| CM-26217 | NCLU does not allow you to configure OSPF NSSAs. For example:cumulus@switch:~$ net add ospf area 0.0.0.1 nssa To work around this issue, use FRR instead. For example: switch# configure terminal | 3.7.7-3.7.10 |
| CM-26181 | ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).-A FORWARD -i swp+ -j LOG You can now install such rules with swp+. | 3.7.3-3.7.10 |
| CM-26179 | If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error:ERROR: ‘ascii’ codec can’t encode character u’\xe9’ in position 3: ordinal not in range(128) | 3.7.7-3.7.10 |
| CM-26169 | Cumulus Linux does not map QinQ packets to VXLANs in a configuration with a VLAN-aware bridge and MLAG on the Trident3 platform. | 3.7.9-3.7.10 |
| CM-26158 | On the Mellanox switch, UFT profiles are unable to support the documented capacity for routes to addresses that are more than 64 bits in length. The listed capacities assume 64-bit destination IP addresses. | 3.7.8-3.7.10 |
| CM-26146 | clagd memory consumption increases under certain unknown conditions. | 3.7.8-3.7.10 |
| CM-26082 | The following vulnerabilities are only applicable if qemu is installed from the repo mirror. It is not present in the base image by default, so base images without qemu installed are not vulnerable. CVE-2018-20815 CVE-2019-13164 CVE-2019-14378: Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service, the execution of arbitrary code or bypass of ACLs. Cumulus Linux 3: >= 2.1+dfsg-12+deb8u12 fixed. https://security-tracker.debian.org/tracker/qemu https://security-tracker.debian.org/tracker/CVE-2018-20815 https://security-tracker.debian.org/tracker/CVE-2019-13164 https://security-tracker.debian.org/tracker/CVE-2019-14378 | 3.7.10 |
| CM-25973 | After a remote VTEP peer link goes down, the tunnel destination IP address might be incorrect in hardware, which might cause loss of overlay communication between VTEPs. | 3.7.8-3.7.10 |
| CM-25955 | Lenovo switches do not send or receive LLDP on eth0 interfaces. | 3.7.7-3.7.10 |
| CM-25824 | NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. | 3.7.3-3.7.10 |
| CM-25747 | When transitioning from a down state to an up state due to peerlink failure and recovery, MLAG does not start the initDelay timer before trying to bring everything back up. | 3.7.7-3.7.10 |
| CM-25718 | IF-MIB::ifHCInOctets reports significantly lower values than reported by interface counters seen elsewhere. | 3.7.6-3.7.10 |
| CM-25704 | The following CVEs affect the linux package: CVE-2019-13272 It was discovered that the ptrace subsystem in the Linux kernel mishandles the management of the credentials of a process that wants to create a ptrace relationship, allowing a local user to obtain root privileges under certain scenarios. Cumulus Linux is not affected. For the detailed security status of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/CVE-2019-13272 | |
| CM-25693 | After you issue the NCLU net del bgp vrf <vrf> autonomous-system <AS> command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. | 3.7.3-3.7.10 |
| CM-25672 | snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. | 3.7.4-3.7.10 |
| CM-25640 | When you configure the switch to send an EAP request with the net add dot1x send-eap-request-id command, the switch ignores re-authentication attempts and does not send back an EAPol. | 3.7.6-3.7.10 |
| CM-25505 | In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result. In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example:
| 3.7.6-3.7.10 |
| CM-25447 | When you define a trap destination using @mgmt, snmpd indicates that the network is unreachable even though the IP address is reachable in the management VRF.To work around this issue, remove @mgmt vrf references in the /etc/snmp/snmpd.conf file, stop snmpd, then start snmpd manually in the management VRF with the systemctl start snmpd@mgmt command. | 3.7.6-3.7.10 |
| CM-25376 | When you generate a cl-support file, clagd.service prints log messages similar to the following:019-03-21T07:18:15.727581+00:00 leaf01 clagd[20912]: DumpThreadStacks - start 2019-03-21T07:18:15.728157+00:00 leaf01 clagd[20912]: #012thread: CollectSysInfo (140608446367488) 2019-03-21T07:18:15.735986+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 783, in __bootstrap 2019-03-21T07:18:15.736585+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 810, in __bootstrap_inner 2019-03-21T07:18:15.737045+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 763, in run 2019-03-21T07:18:15.737933+00:00 leaf01 clagd[20912]: file: /usr/sbin/clagd, line 930, in CollectSysInfoT 2019-03-21T07:18:15.739527+00:00 leaf01 clagd[20912]: file: /usr/sbin/clagd, line 187, in CollectSysInfo 2019-03-21T07:18:15.740540+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 621, in wait 2019-03-21T07:18:15.742293+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/dist-packages/clag/clagthread.py, line 48, in wait . . 2019-03-21T07:18:16.456061+00:00 leaf01 clagd[20912]: DumpThreadStacks - end | 3.7.6-3.7.10 |
| CM-25298 | The following CVEs were announced in a Debian Security Advisory that affects vim modelines. Package: vim and neovim CVE ID: CVE-2019-12735 Debian Bugs: 930020, 930024 getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim. For the detailed security status, refer to the security tracker page at: https://security-tracker.debian.org/tracker/CVE-2019-12735 https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12735.html https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md Cumulus Networks recommends that you disable modelines in the the vimrc file (set nomodeline) to use the securemodelines plugin or to disable modelineexpr (since patch 8.1.1366, Vim-only) to disallow expressions in modelines.To check if you have modelines enabled, open vim and enter: :set modeline? If vim returns nomodeline, you are not vulnerable. If you are vulnerable or you want to ensure your security with this issue, add these lines to your vimrc file:set modelines=0 set nomodeline modeline is enabled by default. Verify that you do not have any existing lines in .vimrc that set modelines or modeline. | 3.0.0-3.7.10 |
| CM-23016 | When FRR restarts, snmp<span class="error">[err]</span> dev/kmem: Permission denied error messages are recorded in the log file and SNMPd might crash periodically. | 3.7.5-3.7.10 |
| CM-22605 | On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0.To work around this issue:
| 3.5.3-3.7.10 |
| CM-22538 | When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:/etc/frr/daemons was modified by another user. Despite this error, the change is made and the description is removed from the frr.conf file. | 3.6.2-3.7.10 |
| CM-22277 | On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. | 3.7.3-3.7.10 |
| CM-21373 | Debian issued the following security advisory, DSA-4231-1, which affects the libgcrypt20 package. This advisory applies only to the the Debian Stretch release. Debian Jessie, upon which Cumulus Linux 3.0 - 3.6.2 is based, is vulnerable. CVE-2018-0495 It was discovered that Libgcrypt is prone to a local side-channel attack allowing recovery of ECDSA private keys. For the stable distribution (stretch), this problem has been fixed in version 1.7.6-2+deb9u3. We recommend that you upgrade your libgcrypt20 packages. For the detailed security status of libgcrypt20, refer to its security tracker page at: https://security-tracker.debian.org/tracker/libgcrypt20 | 3.6.2-3.7.10 |
| CM-21278 | The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment. | 3.5.3-3.7.10 |
| CM-20534 | The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.10 |
| CM-20132 | On Trident2 switches running 802.3x regular link pause, pause frames are accounted in HwIfInDiscards counters and are dropped instead of processed. | 3.5.2-3.7.10 |
| CM-18727 | On the Mellanox SN-2100 switch, unicast packets are counted in multicast queue counters. | 3.4.3-3.7.10 |
| CM-15278 | During a link flap test, you might occasionally see a message similar to: warning: swp6: netlink: cannot set link swp6 down: <span class="error">[Errno 98]</span> Address already in use. | 3.7.6-3.7.10 |
| CM-13316 | When you try to remove a VNI from a bridge using a regex match, the VNI is added back when you run the ifreload -a command. | 3.1.1-3.7.10 |
3.7.10 Release Notes
Open issues in 3.7.10
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-29740 | The exim4 package available for optional installation on Cumulus Linux 3.x has the following vulnerability:DLA-2213-1 / CVE-2020-12783: Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. The spa authentication driver is not enabled by default. Vulnerable: <= 4.84.2-2+deb8u6 Fixed: 4.84.2-2+deb8u7 | 3.0.0-3.7.12 | |
| CM-29556 | CVE-2020-11868: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp. This affects: ntp-4.2.8p12 (possibly earlier) and ntp-4.2.8p13 The fix for https://bugs.ntp.org/3445 introduced a bug whereby a system that is running ntp-4.2.8p12 or p13 that only has one unauthenticated time source can be attacked in a way that causes the victim’s next poll to its source to be delayed, for as long as the attack is maintained. http://support.ntp.org/bin/view/Main/NtpBug3592 gives the following mitigations if it is not possible to upgrade to a version with the fix:
| 3.0.0-3.7.12 | |
| CM-29518 | The following vulnerability affects the ruby2.1 package, which is installed by default: CVE-2020-10663: The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.1 has an unsafe object creation vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. Vulnerable: 2.1.5-2+deb8u9 Fixed: 2.1.5-2+deb8u10 | 3.0.0-3.7.12 | |
| CM-29484 | The following vulnerability affects libgd2/libgd3: CVE-2018-14553: gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled). Vulnerable: <= 2.1.0-5+deb8u13 Fixed: 2.1.0-5+deb8u14 | 3.0.0-3.7.12 | |
| CM-29483 | The following vulnerability affects imptool: CVE-2020-5208: It’s been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. Vulnerable: <= 1.8.14-4 Fixed: 1.8.14-4+deb8u1 | 3.0.0-3.7.12 | |
| CM-29284 | The following vulnerabilities affect git, which is available in the repository for optional installation: CVE-2020-5260: Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. CVE-2020-11008: Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. | 3.0.0-3.7.12 | |
| CM-29208 | The following vulnerability has been announced in ceph; the associated libraries librados2 and librbd1 are available in the Cumulus Linux 3 repository for optional installation. CVE-2020-1760: It was discovered that there was a header-splitting vulnerability in ceph, a distributed storage and file system. Vulnerable: <= 0.80.7-2+deb8u2 Fixed: 0.80.7-2+deb8u4 | 3.0.0-3.7.12 | |
| CM-29048 | The following vulnerability exists in the ruby2.1 package: CVE-2016-2338: An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer “head” allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow Vulnerable: <= 2.1.5-2+deb8u8 Fixed: 2.1.5-2+deb8u9 | 3.0.0-3.7.12 | |
| CM-29040 | The following issue has been found in e2fsprogs, a package that contains ext2/ext3/ext4 file system utilities:CVE-2019-5188: A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. | 3.0.0-3.7.12 | |
| CM-28995 | After you flap an MLAG peerlink, a rare condition might occur where routes and neighbors for VXLAN-enabled VLANs are misprogrammed as non-VXLAN routes and neighbors due to VNI state transitions. This results in a forwarding failure for traffic destined to these misprogrammed routes and neighbors. Note: Do not flap a VNI interface manually. The only expected time for a VNI interface to go down is when the MLAG secondary switch brings the VNIs protodown during a peer link failure where the backup IP address is still active. To recover from this condition, restart switchd with the sudo systemctl restart switchd command. | 3.7.10-3.7.12 | |
| CM-28993 | The following security vulnerability has been announced that affects the libicu52 package: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. Vulnerable: <= 52.1-8+deb8u7 Fixed: 52.1-8+deb8u8 | 3.0.0-3.7.12 | |
| CM-28992 | The following security vulnerability has been announced: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. | 3.0.0-3.7.12 | |
| CM-28954 | The python-twisted-* packages, which are available for optional installation in Cumulus Linux but are not installed by default, were found to have the following security vulnerabilities: CVE-2020-10808: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request. CVE-2020-10809: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request. | 3.0.0-3.7.12 | |
| CM-28944 | A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted. To work around this issue, reenter the redistribute <connected\|static> route-map <route-map-name> statement in the configuration. | 3.6.2-3.7.12 | |
| CM-28938 | When you install an ACL LOG/DROP rule on a layer 3 ingress interface that is a member of a VRF, traffic that matches this rule is not logged and is still forwarded. To work around this issue, apply the ACL LOG/DROP rule to the VRF device itself or to the layer 2 VNI. | 3.7.6-3.7.12 | |
| CM-28867 | The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12 | |
| CM-28816 | The following security advisory has been announced for bash: CVE-2019-18276 Qualys scan QID 372268 setuid vulnerability When bash or bash scripts are run setuid, bash is supposed to drop privileges, but does so incorrectly, so that an attacker with command access to the shell can use enable -f for runtime loading of a new builtin that calls setuid() to regain dropped privileges.To work around this issue, do not make bash or bash scripts setuid. | 3.0.0-3.7.12 | |
| CM-28811 | The following security vulnerability affects the libvpx1 library:CVE-2020-0034: It was discovered that there was an out-of-bounds buffer read vulnerability in libvpx, a library implementing the VP8 & VP9 videocodecs. | 3.0.0-3.7.12 | |
| CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.12 | |
| CM-28655 | When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.6.1-3.7.12 | |
| CM-28488 | The following CVEs were announced that affect the cron package. All of these require untrusted local user access.CVE-2017-9525 is a local user privilege escalation attack: In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs. CVE-2019-9704, CVE-2019-9705, CVE-2019-9706 are local user denial of service attacks. Note: the fix for CVE-2019-9705 imposes a limitation on the length of a crontab file (the vulnerability was that an unlimited size crontab file could cause excessive memory consumption). https://security-tracker.debian.org/tracker/DLA-1723-1 | 3.0.0-3.7.12 | |
| CM-28487 | The following CVE was announced for rsyslog: CVE-2019-17041 CVE-2019-17042 rsyslogd, when receiving remote log messages and using optional pmaixforwardedfrom or pmcisconames parser modules (not enabled by default on Cumulus Linux), is vulnerable to CVE-2019-17041 and CVE-2019-17042 where malicious messages that appear to be from AIX or Cisco respectively may be caused to skip sanity checks, resulting in incorrect negative lengths causing heap overflows.Do not enable (with $UDPServerRun or $InputTCPServerRun) receiving syslog messages from other hosts by the network. Also, do not enable (with $ModLoad) the vulnerable parsers pmaixforwardedfrom or pmcisconames.<br/>The default /etc/rsyslog.conf file on Cumulus Linux does NOT enable $UDPServerRun or $InputTCPServerRun, so the vulnerability is not network exploitable in the default configuration. In addition, the vulnerable parsers are not enabled in the default configuration. | 3.0.0-3.7.12 | |
| CM-28486 | The following vulnerability has been found in the libgcrypt20 cryptographic library. CVE-2019-13627: there was a ECDSA timing attack. For more information, see https://www.debian.org/lts/security/2020/dla-1931-2.en.html Vulnerable: 1.6.3-2+deb8u7 Fixed: 1.6.3-2+deb8u8 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28485 | The following vulnerability affects libxml2: CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c has a memory leak related to newDoc->oldNs. This can lead to a denial of service. For more information, see https://www.debian.org/lts/security/2019/dla-2048.en.html . Vulnerable: 2.9.1+dfsg1-5+deb8u7 Fixed: 2.9.1+dfsg1-5+deb8u8 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28484 | The following vulnerability affects libbsd, a package containing utility functions from BSD systems. CVE-2016-2090: In function fgetwln() an off-by-one error could triggers a heap buffer overflow. For more information, see https://www.debian.org/lts/security/2019/dla-2052.en.html . Vulnerable: 0.7.0-2 Fixed: 0.7.0-2+deb8u1 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28462 | On rare occasions, when you upgrade Cumulus Linux with the apt-get upgrade command, the upgrade fails and reports No space left on device. Checking the disk utilization shows that the disk is not full.To work around this issue, run the apt-get upgrade command again and reboot the device if prompted to complete the upgrade. | 3.7.10-3.7.12 | |
| CM-28393 | On the Dell S5232F-ON switch, EVPN and dynamic VRF route leaking results in the CPU forwarding traffic to newly-learned type-2 routes. To work around this issue, restart FRR. | 3.7.9-3.7.12 | |
| CM-28374 | When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-3.7.12 | |
| CM-28276 | When a Trident3 switch receives packets containing an IP checksum value that is not compliant with RFC 1624, the TTL is decremented after a routing operation but the checksum is not recalculated. This results in the IP checksum value being invalid as the packet leaves the switch. | 3.7.10-3.7.11 | 3.7.12 |
| CM-28224 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2019-15890: libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. Vulnerable: <= 2.1+dfsg-12+deb8u11 Fixed: 2.1+dfsg-12+deb8u12 | 3.0.0-3.7.10 | 3.7.11-3.7.12 |
| CM-28223 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-1711: block: iscsi: OOB heap access via an unexpected response of iSCSI Server | 3.0.0-3.7.12 | |
| CM-28222 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-7039: tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code. Vulnerable: <= 2.1+dfsg-12+deb8u12 Fixed: 2.1+dfsg-12+deb8u13 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28219 | The following vulnerability affects sudo, which is installed by default on Cumulus Linux. It is potentially exploitable on Cumulus Linux if pwfeedback (which is NOT enabled by default) is enabled in the /etc/sudoers file. CVE-2019-18634: In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c. For more information, refer to: https://security-tracker.debian.org/tracker/source-package/sudo https://security-tracker.debian.org/tracker/CVE-2019-18634 https://www.sudo.ws/alerts/pwfeedback.html Vulnerable: <= 1.8.10p3-1+deb8u6 Fixed: 1.8.10p3-1+deb8u7 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28160 | On the Broadcom Trident3 switch with DHCP relay, where the DHCP server is reachable through the EVPN overlay, DHCP discover packets forwarded to the CPU might appear corrupt and might not get forwarded. | 3.7.9-3.7.12 | |
| CM-28136 | The MLAG switch pair has VLANs defined that are not used on MLAG bonds. These VLANs still synchronize MAC addresses across to the peer switch. This results in log messages that indicate a MAC address is installed and the VLAN is not defined; for example:RTM_NEWNEIGH with unconfigured vlan XXXX on port peerlink | 3.7.10-3.7.12 | |
| CM-28091 | Two security issues were found in the Python interface to the apt package manager, which is installed by default on Cumulus Linux; package downloads from unsigned repositories were incorrectly rejected (CVE-2019-15796) and the hash validation relied on MD5 (CVE-2019-15795). For more information, refer to https://security-tracker.debian.org/tracker/source-package/python-apt Vulnerable: 0.9.3.12 Fixed: 0.9.3.13 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28077 | An unhandled exception might occur after you run the sudo poectl -i command. In addition, random poed daemon restarts can occur without any unhandled exceptions but with an invalid response length error. Both issues can occur due to a SerialException.To work around this issue, power cycle the switch. A software reboot does not resolve the issue. | 3.7.10-3.7.11 | 3.7.12 |
| CM-28076 | After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom --init command. | 3.6.0-3.7.12 | |
| CM-28016 | On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. | 3.7.7-3.7.11 | 3.7.12 |
| CM-28007 | When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 | 3.7.12 |
| CM-27999 | On the EdgeCore AS7326-56X switch, the PSU fans show constant LOW warnings. | 3.7.10-3.7.12 | |
| CM-27982 | On Broadcom switches, switchd crashes when dynamic VRF route leaking is enabled and the following is true:
| 3.7.10-3.7.12 | |
| CM-27947 | Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. | 3.7.0-3.7.11 | 3.7.12 |
| CM-27937 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 One of the listed vulnerabilities is still present in the latest upstream version 2.1+dfsg-12+deb8u12 (the others have been fixed): CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. https://security-tracker.debian.org/tracker/CVE-2017-15124 | 3.0.0-3.7.12 | |
| CM-27924 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.26.dfsg1-13+deb8u1 Fixed: 2.1.26.dfsg1-13+deb8u2 | 3.0.0-3.7.11 | 3.7.12 |
| CM-27855 | The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. | 3.7.0-3.7.11 | 3.7.12 |
| CM-27814 | A traditional bridge with QinQ and a VNI does not work for tagged traffic. | 3.7.10-3.7.12 | |
| CM-27804 | You might see a switchd memory leak during ECMP group expansion or consolidation. | 3.7.10-3.7.11 | 3.7.12 |
| CM-27793 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.27+dfsg-1 Fixed: 2.1.27+dfsg-1+deb10u1 | 3.0.0-3.7.12 | |
| CM-27764 | On the EdgeCore AS7326-56X switch, eth0 and swp1 use the same MAC address. | 3.7.9-3.7.11 | 3.7.12 |
| CM-27698 | SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.12 | |
| CM-27683 | The following CVEs were announced that affect the Linux kernel: CVE-2019-12378: An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-12381: An issue was discovered in ip_ra_control in net/ipv4/ip_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-15239: In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation. CVE-2019-19062: A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042. CVE-2019-19537: In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID-303911cfc5b9. This affects drivers/usb/core/file.c. CVE-2019-20054: In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e. | 3.0.0-3.7.11 | 3.7.12 |
| CM-27670 | A memory leak in switchd might occur, which causes switchd to restart. | 3.7.10-3.7.11 | 3.7.12 |
| CM-27646 | Several vulnerabilities have been discovered in Git, a fast, scalable, distributed revision control system, which is available in the Cumulus Linux 3.x repositories for optional installation. CVE-2019-1348: export-marks is insecure, fix is to disable by default. CVE-2019-1349: .git / git~1 filename vulnerability on NTFS CVE-2019-1352: .git vulnerability with NTFS Alternate Streams Accesses CVE-2019-1353: NTFS filesystem protection should be on by default CVE-2019-1387: dubiously-nested submodule git directories should be disallowed CVE-2019-19604: submodule update repository code execution vulnerability Vulnerable: <= 2.1.4-2.1+deb8u7 Fixed: 2.1.4-2.1+deb8u8 | 3.0.0-3.7.12 | |
| CM-27644 | Ifupdown2 does not set up the front panel interface for the dhclient to accept the DHCP OFFER.To work around this issue, restart the networking service after ifreload -a with the systemctl restart networking command. | 3.7.10-3.7.11 | 3.7.12 |
| CM-27628 | The following security vulnerabilities have been announced in the nss/libnss3 library, which is not installed by default but is available in the repository: CVE-2019-11745: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate CVE-2019-17007: nss: Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may crash with a NULL deref leading to DoS See https://security-tracker.debian.org/tracker/source-package/nss for more information. Vulnerable: <= 3.26-1+debu8u7 Fixed: 3.26-1+debu8u9 | 3.0.0-3.7.10 | 3.7.11-3.7.12 |
| CM-27530 | When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. | 3.7.10-3.7.12 | |
| CM-27522 | The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. | 3.7.10-3.7.12 | |
| CM-27507 | The ports.conf file on the Dell S5248F-ON switch does not show port ganging or breakout options. | 3.7.10-3.7.11 | 3.7.12 |
| CM-27457 | If you delete, then re-add a PBR policy on an interface, the configured PBR policy is not programmed in the kernel or switchd. | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-27456 | After making a series of PBR configuration changes using NCLU commands, the stale PBR entry is still present in the kernel. | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-27444 | If you use the NCLU commands to configure NTP and run the net add time ntp source <interface> command before you run the net add time ntp server <server> iburst command, the /etc/ntp.conf file is misconfigured.To work around this issue, run the net add time ntp server <server> iburst command before you run the net add time ntp source <interface> command. | 3.7.10-3.7.11 | 3.7.12 |
| CM-27354 | On the Celestica Pebble switch, if you use IPv6 routes with mask /65 to /127, the switchd log fills with errors. | 3.7.10-3.7.12 | |
| CM-27351 | On rare occasions, after rebooting the MLAG secondary switch, one MLAG device might see the peer as down, which can cause traffic disruption to connected hosts. | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-27321 | The following CVEs were announced that affect the ghostscript package: CVE-2019-14869: Manfred Paul and Lukas Schauer reported that the .charkeys procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. Cumulus Linux 3: <= 9.26a~dfsg-0+deb8u5 vulnerable, >= 9.26a~dfsg-0+deb8u6 fixed. https://security-tracker.debian.org/tracker/ghostscript https://security-tracker.debian.org/tracker/CVE-2019-14869 | 3.7.10 | 3.7.11-3.7.12 |
| CM-27299 | The protocol daemon bgpd crashes when a link/neighbor flaps if static routes pointing to Null0 are advertising through BGP.To work around this issue, reboot the switch, then remove the static routes or stop advertising these routes. | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-27295 | IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.[ip6tables] | 3.7.2-3.7.11 | 3.7.12 |
| CM-27279 | When ECMP routes have both VXLAN (symmetric routing) and non-VXLAN paths, the non-VXLAN path is incorrectly installed in the RIB and FIB to point across VXLAN. The non-VXLAN next-hop will be installed as an offload entry in the neighbor table (ip neigh show) with a mac address of 00:00:00:00:00:00. | 3.7.3-3.7.12 | |
| CM-27243 | The length of the netlink message is not set properly for non-bridge family type messages. The same length is used for both bridge and non-bridge even though the bridge family type message has an extra attribute. This causes extra bytes to be left over in non-bridge family type netlink messages. | 3.7.10 | 3.7.11-3.7.12 |
| CM-27233 | If you change multiple BGP or BFD timers in the /etc/frr/frr.conf file and then reload FRR, a traceback is encountered and the change does not take effect. | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-27193 | The l1-show command prints a traceback for switch ports that have sub-interfaces configured. There is no functional impact to traffic but the l1-show troubleshooting and validation command does not execute on switch ports that have VLAN sub-interfaces. | 3.7.10 | 3.7.11-3.7.12 |
| CM-27192 | If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. | 3.7.10-3.7.12 | |
| CM-27174 | The ospfd daemon might crash with the following kernel trace:2019-11-06T23:00:08.261749+09:00 cumulus ospfd[5339]: Assertion ‘node’ failed in file ospfd/ospf_packet.c, line 671, function ospf_write | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-27173 | On the Trident3 switch, unicast ARP packets received on a VNI and forwarded to the CPU are not policed. | 3.7.10-3.7.12 | |
| CM-27120 | When an interface flap occurs, numbered IPv6 BGP sessions might fail to establish. To work around this issue, run the ip -6 route flush cache <IPv6-address> command to flush the IPv6 route cache. | 3.7.9-3.7.11 | 3.7.12 |
| CM-27096 | On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10 | 3.7.11-3.7.12 |
| CM-27094 | On the Delta AG9032v1 switch, smonctl and sensors report inaccurate PSU current and power. | 3.5.0-3.7.12 | |
| CM-27025 | On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. | 3.7.2-3.7.10 | 3.7.11-3.7.12 |
| CM-27018 | If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.12 | |
| CM-26996 | On the Mellanox switch with the Spectrum ASIC, the --set-burst parameter in an iptables rule does not take effect. | 3.7.10 | 3.7.11-3.7.12 |
| CM-26968 | When networking fails to start properly, an MLAG memory leak occurs, which might cause memory issues. | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-26954 | In the default VRF, VRRP might crash and stay in an initialize state. As a result, VRRP multicast traffic is not generated. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26921 | If you delete an undefined bond, then add a bond slave, the net commit command fails. | 3.7.9-3.7.12 | |
| CM-26913 | FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:sudo sh -c “printf ‘interface 50\nvrf TEST description L3 routing interface\n’ » /etc/frr/frr.conf" should be: sudo sh -c “printf ‘interface 50 vrf TEST\ndescription L3 routing interface\n’ » /etc/frr/frr.conf" To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. | 3.7.9-3.7.12 | |
| CM-26905 | When you update the hostname of a switch with the NCLU net add hostname <hostname> command, then run net commit, the lldpd service does not restart and other devices still see the old name.To work around this issue, run the sudo systemctl restart lldpd.service command. | 3.7.10-3.7.12 | |
| CM-26894 | The neighmgrd service does not ignore neighbors on reserved devices (lo and management devices). This issue is not seen when management VRF is enabled. | 3.7.8-3.7.11 | 3.7.12 |
| CM-26875 | After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. | 3.7.9-3.7.12 | |
| CM-26838 | You might experience a bgpd memory usage increase and significant update exchanges due to host moves between VTEPs. | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-26829 | Frames received with a VLAN tag of 0 on an interface configured as a bridge port and forwarded to the CPU for processing might appear tagged with the native VLAN when viewed with tcpdump. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26815 | If a router MAC address changes on a VTEP, other VTEPs might still point to the previous router MAC address. | 3.7.10 | 3.7.11-3.7.12 |
| CM-26769 | Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26691 | BGP is configured with soft reconfiguration-in for its peers, which is not working correctly and causes routes to have an unexpected label. As a result, transit traffic is not forwarded by the switch. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26657 | When you install a large number of new rules with nonatomic mode enabled, there is a chance that you install more rules than the number of available slots in the slice, which results in the slice being completely wiped and reinstalled. This causes a large drop increase, including to cpu0, and might cause a major outage by dropping all BGP sessions. | 3.6.1-3.7.10 | 3.7.11-3.7.12 |
| CM-26655 | If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:net add time ntp server 1.2.3.4 iburst If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. | 3.7.9-3.7.12 | |
| CM-26599 | Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. | 3.7.9-3.7.12 | |
| CM-26595 | The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. | 3.7.9-3.7.12 | |
| CM-26525 | When an MLAG peerlink frequently alternates states between learning and blocking, an excessive number of TCP sessions might be created, which results in the following error display:OSError: [Errno 24] Too many open files | 3.6.2-3.7.10 | 3.7.11-3.7.12 |
| CM-26523 | Package: hostapd CVE ID: CVE-2019-13377 CVE-2019-16275 Two vulnerabilities were found in the WPA protocol implementation found in wpa_supplication (station) and hostapd (access point). CVE-2019-13377 A timing-based side-channel attack against WPA3’s Dragonfly handshake when using Brainpool curves could be used by an attacker to retrieve the password. CVE-2019-16275 Insufficient source address validation for some received Management frames in hostapd could lead to a denial of service for stations associated to an access point. An attacker in radio range of the access point could inject a specially constructed unauthenticated IEEE 802.11 frame to the access point to cause associated stations to be disconnected and require a reconnection to the network. Fixed version: 1:2.8.0-cl4u3 | 3.7.0-3.7.10 | 3.7.11-3.7.12 |
| CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.12 | |
| CM-26463 | The following CVEs affect the linux kernel package: CVE-2019-14821 CVE-2019-14835 CVE-2019-15117 CVE-2019-15118 CVE-2019-15902 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.7.10-3.7.12 | |
| CM-26450 | Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-26448 | Traffic sent to the SVI IP address of a switch might be lost if all of the following conditions are met:
To workaround this issue, restart switchd. | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-26437 | NCLU crashes when you run the net add interface storage-optimized pfc command because non-ascii quotes exist in the datapath.conf file.To work around this issue, manually edit the /usr/lib/python2.7/dist-packages/cumulus/__chip_config/mlx/datapath.conf file and replace the non-ascii single quotes with ascii single quotes (standard single quote on the keyboard). | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.12 | |
| CM-26412 | Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. | 3.7.9-3.7.12 | |
| CM-26372 | FRR crashes when adding an IPv6 neighbor with extended-nexthop capability. | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-26351 | After you remove a subinterface, the BGP session stays in a Connect state. | 3.7.8-3.7.11 | 3.7.12 |
| CM-26308 | An interface alias configured outside FRR using iproute2 is imported into the FRR running configuration and overrides the internal description. After an FRR reload, this causes FRR to delete the interface alias in an inefficient way. Depending on how many interfaces with aliases you have configured, this can cause a FRR reload to time out.To work around this issue, remove the interface alias description from iproute2. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26288 | On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.12 | |
| CM-26272 | On the Mellanox Spectrum switch, a route withdrawal might cause the associated next hop neighbor entry to be deleted in hardware but remain in the kernel. This can cause traffic going through the directly connected route to the removed neighbor entry to be forwarded to the CPU. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26256 | The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. | 3.7.8-3.7.12 | |
| CM-26255 | On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26252 | The following CVEs were announced that affect the ghostscript package: CVE ID : CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817 It was discovered that various procedures in Ghostscript, the GPL PostScript/PDF interpreter, do not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.7.0-3.7.10 | 3.7.11-3.7.12 |
| CM-26241 | On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. | 3.7.6-3.7.11 | 3.7.12 |
| CM-26230 | When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. | 3.7.8-3.7.12 | |
| CM-26225 | On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:2019-09-05T05:15:17.246597+00:00 hp-6712-03 decode-syseeprom: Unable to find eeprom at /sys/bus/i2c/devices/11-0050/eeprom for psu2 | 3.7.9-3.7.12 | |
| CM-26217 | NCLU does not allow you to configure OSPF NSSAs. For example:cumulus@switch:~$ net add ospf area 0.0.0.1 nssa To work around this issue, use FRR instead. For example: switch# configure terminal | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-26181 | ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).-A FORWARD -i swp+ -j LOG You can now install such rules with swp+. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-26179 | If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error:ERROR: ‘ascii’ codec can’t encode character u’\xe9’ in position 3: ordinal not in range(128) | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-26169 | Cumulus Linux does not map QinQ packets to VXLANs in a configuration with a VLAN-aware bridge and MLAG on the Trident3 platform. | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-26158 | On the Mellanox switch, UFT profiles are unable to support the documented capacity for routes to addresses that are more than 64 bits in length. The listed capacities assume 64-bit destination IP addresses. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26147 | On the EdgeCore AS4610 switch, the ping command fails unless you run the command with sudo.To work around this issue, run the following commands: cumulus@switch:~$ sudo setcap cap_net_raw+ep /usr/share/mgmt-vrf/bin/ping Run the following command to verify the workaround:
You should see the following output:
| 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26146 | clagd memory consumption increases under certain unknown conditions. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26139 | Selective ERSPAN does not work when you specify a bridge port. | 3.7.6-3.7.12 | |
| CM-26138 | You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:-A FORWARD -i swp5 -s 00:25:90:b2:bd:9d -d 50:6b:4b:96:c4:04 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64 | 3.7.6-3.7.12 | |
| CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:-A FORWARD -i vni10 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64 | 3.7.6-3.7.12 | |
| CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.12 | |
| CM-26126 | Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.12 | |
| CM-26082 | The following vulnerabilities are only applicable if qemu is installed from the repo mirror. It is not present in the base image by default, so base images without qemu installed are not vulnerable. CVE-2018-20815 CVE-2019-13164 CVE-2019-14378: Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service, the execution of arbitrary code or bypass of ACLs. Cumulus Linux 3: >= 2.1+dfsg-12+deb8u12 fixed. https://security-tracker.debian.org/tracker/qemu https://security-tracker.debian.org/tracker/CVE-2018-20815 https://security-tracker.debian.org/tracker/CVE-2019-13164 https://security-tracker.debian.org/tracker/CVE-2019-14378 | 3.7.10 | 3.7.11-3.7.12 |
| CM-26024 | On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. | 3.7.7-3.7.12 | |
| CM-25973 | After a remote VTEP peer link goes down, the tunnel destination IP address might be incorrect in hardware, which might cause loss of overlay communication between VTEPs. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-25955 | Lenovo switches do not send or receive LLDP on eth0 interfaces. | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-25923 | The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. | 3.7.8-3.7.12 | |
| CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.12 | |
| CM-25859 | The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. | 3.7.7-3.7.12 | |
| CM-25824 | NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.12 | |
| CM-25796 | Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:ifdown vlan123 ; sleep 2 ; ifup vlan123 You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. | 3.7.5-3.7.12 | |
| CM-25794 | Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.12 | |
| CM-25766 | On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. | 3.7.7-3.7.12 | |
| CM-25747 | When transitioning from a down state to an up state due to peerlink failure and recovery, MLAG does not start the initDelay timer before trying to bring everything back up. | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:cumulus@switch:~$ net add bridge mybridge vlan-protocol 802.1ad | 3.7.6-3.7.12 | |
| CM-25718 | IF-MIB::ifHCInOctets reports significantly lower values than reported by interface counters seen elsewhere. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25694 | If a packet is policed by ebtables, it does not increment an ACL drop on the ingress interface. Instead, it increments the TDBGC3/6 drop counter to the CPU. | 3.7.6-3.7.12 | |
| CM-25693 | After you issue the NCLU net del bgp vrf <vrf> autonomous-system <AS> command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-25672 | snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. | 3.7.4-3.7.10 | 3.7.11-3.7.12 |
| CM-25665 | On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur:
| 3.7.5-3.7.11 | 3.7.12 |
| CM-25641 | If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl.To work around this issue, power cycle the switch. | 3.7.6-3.7.12 | |
| CM-25640 | When you configure the switch to send an EAP request with the net add dot1x send-eap-request-id command, the switch ignores re-authentication attempts and does not send back an EAPol. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25505 | In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result. In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example:
| 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25447 | When you define a trap destination using @mgmt, snmpd indicates that the network is unreachable even though the IP address is reachable in the management VRF.To work around this issue, remove @mgmt vrf references in the /etc/snmp/snmpd.conf file, stop snmpd, then start snmpd manually in the management VRF with the systemctl start snmpd@mgmt command. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25404 | hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. | 3.7.6-3.7.12 | |
| CM-25400 | If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. | 3.7.6-3.7.12 | |
| CM-25397 | When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. | 3.7.3-3.7.12 | |
| CM-25376 | When you generate a cl-support file, clagd.service prints log messages similar to the following:019-03-21T07:18:15.727581+00:00 leaf01 clagd[20912]: DumpThreadStacks - start 2019-03-21T07:18:15.728157+00:00 leaf01 clagd[20912]: #012thread: CollectSysInfo (140608446367488) 2019-03-21T07:18:15.735986+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 783, in __bootstrap 2019-03-21T07:18:15.736585+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 810, in __bootstrap_inner 2019-03-21T07:18:15.737045+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 763, in run 2019-03-21T07:18:15.737933+00:00 leaf01 clagd[20912]: file: /usr/sbin/clagd, line 930, in CollectSysInfoT 2019-03-21T07:18:15.739527+00:00 leaf01 clagd[20912]: file: /usr/sbin/clagd, line 187, in CollectSysInfo 2019-03-21T07:18:15.740540+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 621, in wait 2019-03-21T07:18:15.742293+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/dist-packages/clag/clagthread.py, line 48, in wait . . 2019-03-21T07:18:16.456061+00:00 leaf01 clagd[20912]: DumpThreadStacks - end | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25298 | The following CVEs were announced in a Debian Security Advisory that affects vim modelines. Package: vim and neovim CVE ID: CVE-2019-12735 Debian Bugs: 930020, 930024 getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim. For the detailed security status, refer to the security tracker page at: https://security-tracker.debian.org/tracker/CVE-2019-12735 https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12735.html https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md Cumulus Networks recommends that you disable modelines in the the vimrc file (set nomodeline) to use the securemodelines plugin or to disable modelineexpr (since patch 8.1.1366, Vim-only) to disallow expressions in modelines.To check if you have modelines enabled, open vim and enter: :set modeline? If vim returns nomodeline, you are not vulnerable. If you are vulnerable or you want to ensure your security with this issue, add these lines to your vimrc file:set modelines=0 set nomodeline modeline is enabled by default. Verify that you do not have any existing lines in .vimrc that set modelines or modeline. | 3.0.0-3.7.10 | 3.7.11-3.7.12 |
| CM-25001 | The following CVEs were announced in Debian Security Advisory DSA-444-1, DSA-4447-1 and affect the linux kernel and microcode. Package: linux CVE ID: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 Multiple researchers have discovered vulnerabilities in the way the Intel processor designs have implemented speculative forwarding of data filled into temporary microarchitectural structures (buffers). This flaw could allow an attacker controlling an unprivileged process to read sensitive information, including from the kernel and all other processes running on the system or cross guest/host boundaries to read host memory. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details. To fully resolve these vulnerabilities it is also necessary to install updated CPU microcode. Contact your hardware ndor for microcode uppdates. In addition, this update includes a fix for a regression causing deadlocks inside the loopback driver. Fixed in version 4.19.76-1+cl4u1 | 3.0.0-3.7.12 | |
| CM-24894 | The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. | 3.7.5-3.7.12 | |
| CM-24803 | On the Dell N3048EP-ON or the Delta AG6248 switch, when you execute the following command, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The Cumulus Linux image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new Cumulus Linux image.The workaround only works when an out-of-band network is present. | 3.7.6-3.7.12 | |
| CM-24799 | On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. | 3.7.5-3.7.12 | |
| CM-24751 | On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. | 3.7.3-3.7.12 | |
| CM-24703 | The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.12 | |
| CM-24686 | On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. | 3.7.3-3.7.12 | |
| CM-24652 | In an EVPN environment, the centralized MAC address is not installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN. This issue does not affect a pure distributed routing (symmetric or asymmetric) environment or a pure centralized routing environment. | 3.7.0-3.7.12 | |
| CM-24618 | If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:ERROR: No closing quotation See /var/log/netd.log for more details. | 3.6.1-3.7.12 | |
| CM-24473 | SNMP incorrectly requires engine ID specification. | 3.7.4-3.7.12 | |
| CM-24435 | When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect: net add routing route-map Proxy-ARP permit 25 match interface swp9-10 These commands are correct: net add routing route-map Proxy-ARP permit 25 match interface swp9 net add routing route-map Proxy-ARP permit 30 match interface swp10 | 3.7.2-3.7.12 | |
| CM-24426 | NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf <name> command just displays
Tab completion for the net add vrf <name> ip address <address> command works correctly. | 3.7.4-3.7.12 | |
| CM-24379 | On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.12 | |
| CM-24343 | The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. | 3.7.4-3.7.12 | |
| CM-24332 | On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. | 3.7.3-3.7.12 | |
| CM-24272 | When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface br0.100 switch(config-if)# vrrp 1 priority 110 switch(config-if)# vrrp 1 advertisement-interval switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24271 | On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface vlan100 switch(config-if)# vrrp 1 priority 110 switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24270 | Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface swp4 switch(config-if)# vrrp 1 version 2 switch(config-if)# no vrrp 1 preempt switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24262 | NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto <iface> lines exist. | 3.7.3-3.7.12 | |
| CM-24241 | When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:cumulus@switch:~$ net del bgp neighbor fabric peer-group ‘router bgp 65001’ configuration does not have ‘neighbor fabric peer-group’ | 3.7.2-3.7.12 | |
| CM-24222 | When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. | 3.7.0-3.7.12 | |
| CM-24035 | On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. | 3.7.2-3.7.12 | |
| CM-23825 | The net add interface <interface> ptm-enable command adds no ptm-enable for that interface in the frr.conf file.Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. | 3.7.2-3.7.12 | |
| CM-23792 | When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table.To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev <interface> command. | 3.7.0-3.7.12 | |
| CM-23696 | IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. | 3.7.2-3.7.12 | |
| CM-23665 | NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan <layer3-vni> bridge access <vlan>. This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.To restore connectivity, remove the VLAN ID from the bridge. | 3.7.2-3.7.12 | |
| CM-23661 | On the Mellanox switch, when you configure a GRE tunnel, the traffic behind the local tunnel endpoint destined through the GRE tunnel is software-forwarded. | 3.7.2-3.7.12 | |
| CM-23651 | In an EVPN symmetric routing configuration, when an IP address is frozen, kernel neighbor table information and kernel VRF routing table information about the frozen IP address might be out-of-sync. | 3.7.3-3.7.12 | |
| CM-23584 | When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. | 3.7.2-3.7.12 | |
| CM-23570 | On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. | 3.7.2-3.7.12 | |
| CM-23422 | portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. | 3.7.0-3.7.12 | |
| CM-23418 | For QSFP modules, the sudo ifdown command does not disable the Tx laser. | 3.7.2-3.7.12 | |
| CM-23417 | If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. | 3.7.0-3.7.12 | |
| CM-23397 | On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. | 3.6.2-3.7.12 | |
| CM-23125 | The OpenSSL package on Cumulus Linux 3.x has a vulnerability similar to CVE-2018-0734. (The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key). According to Debian upstream, this version “is not vulnerable [to CVE-2018-0734 exactly]. Nevertheless, there is a bug fix that futher reduces the amount of leaked timing information. It got no CVE on its own and introduced this vulnerability.“ Vulnerable on CL3: 1.0.1t-1+deb8u12 | 3.0.0-3.7.12 | |
| CM-23123 | When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. | 3.7.2-3.7.12 | |
| CM-23075 | There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:2018-11-10T23:35:30.992370-08:00 Dev dhcrelay: Listening on LPF/vlan.101/a0:00:00:00:00:51 2018-11-10T23:35:30.993472-08:00 Dev dhcrelay: Sending on LPF/vlan.101/a0:00:00:00:00:51 Eventually the dhcrelay service stops. | 3.7.1-3.7.12 | |
| CM-23021 | When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. | 3.7.1-3.7.12 | |
| CM-23016 | When FRR restarts, snmp<span class="error">[err]</span> dev/kmem: Permission denied error messages are recorded in the log file and SNMPd might crash periodically. | 3.7.5-3.7.10 | 3.7.11-3.7.12 |
| CM-23004 | The local fallback account authenticates using the local password when the RADIUS or TACACS service is up. The expected behavior is for this to fail and only succeed when the RADIUS OR TACACS server fails to respond. | 3.7.1-3.7.12 | |
| CM-22937 | NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation.To work around this issue, stop snmpd, remove the cache file, then restart snmpd. | 3.6.0-3.7.12 | |
| CM-22849 | When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur.This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. | 3.7.2-3.7.12 | |
| CM-22808 | When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. | 3.5.2-3.7.12 | |
| CM-22794 | The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. | 3.6.2-3.7.12 | |
| CM-22605 | On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0.To work around this issue:
| 3.5.3-3.7.10 | 3.7.11-3.7.12 |
| CM-22591 | CVE-2018-5391 (FragmentSmack) is a network vulnerability where an attacker can trigger time and calculation expensive fragment reassembly with specially crafted packets, leading to a denial of service. On a Cumulus Linux switch, the impact is limited to control plane and management plane traffic. Any control plane traffic coming in the front panel ports will be limited by existing policer ACLs. To work around this issue, create a file called /etc/sysctl.d/ip.conf and add these settings:net.ipv4.ipfrag_low_thresh = 196608 | 3.7.0-3.7.11 | 3.7.12 |
| CM-22583 | Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. | 3.6.0-3.7.12 | |
| CM-22554 | If you try to bring down several members of a bond remotely at the same time, the link state of one of the interfaces might not transition correctly to the down state; however, all links show down in hardware. | 3.6.2-3.7.12 | |
| CM-22538 | When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:/etc/frr/daemons was modified by another user. Despite this error, the change is made and the description is removed from the frr.conf file. | 3.6.2-3.7.10 | 3.7.11-3.7.12 |
| CM-22386 | The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. | 3.7.0-3.7.12 | |
| CM-22301 | For an unresolved address, the IPROUTER default policer rule has been modified to not match on packets exiting a TUNNEL and headed to the CPU to resolve the address via ARP. As a result, the following default rule no longer matches TUNNEL ingress packets.A $INGRESS_CHAIN –in-interface $INGRESS_INTF -m addrtype –dst-type IPROUTER -j POLICE –set-mode pkt –set-rate 400 –set-burst 100 These packets are now policed by catch all rules. To work around this issue, the VPORT value on a TRIDENT switch must be changed from binary 011 to 100. | 3.6.1-3.7.12 | |
| CM-22287 | On the EdgeCore AS7712 (Tomahawk) switch running in atomic mode, when a layer 3 ECMP path is brought down, traffic traversing the path stops working for about four seconds. When the switch is changed to non-atomic mode, the delay is less than one second. This issue is seen across OSPF and static ECMP routes. | 3.6.2-3.7.12 | |
| CM-22277 | On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-22274 | To ease interoperation with non-Cumulus devices, it is possible to configure the route-target import and export values under the layer 2 VNI EVPN configuration. The same configuration does not work for both layer 2 VNI and layer 3 VNIs. Set the EVPN address-family within the VNI context when configuring the route-target in the layer 2 VNI. Set the EVPN address-family without the VNI context when configuring the route-target in the layer 3 VNI. | 3.6.0-3.7.12 | |
| CM-22252 | On the Edgecore OMP-800, there is no Power Supply information from the sensor or from smonctl. The platform driver has support for the PSUs but this was not added to the sensors infrastructure.This is a known limitation on the OMP-800 platform. | 3.6.2-3.7.12 | |
| CM-22228 | On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.12 | |
| CM-22205 | If a user is in vtysh when FRR is restarted, the running configuration in that vtysh session shows empty. | 3.6.2-3.7.12 | |
| CM-22138 | When you run the NCLU net show system command or the NetQ netq inventory command on the Edgecore OMP-800 switch, the output does not show any port or chip information. | 3.6.2-3.7.12 | |
| CM-22041 | At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. | 3.4.3-3.7.12 | |
| CM-22020 | On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. | 3.7.0-3.7.12 | |
| CM-21927 | When running ifreload on Mellanox Spectrum devices, after updating an interface configuration, sometimes VLANs are not programmed into the hardware data plane. The Linux control plane looks normal but the VLAN has not been programmed into the hardware and packets that arrive for the VLAN might be dropped.To work around this issue, remove and re-add the affected VLANs from the port. | 3.5.3-3.7.12 | |
| CM-21898 | On a Trident3 switch, IGMP packets are not policed by the police rule in the 00control ACL file. The packets are policed by the catchall policer in the 99control ACL file instead.-A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police --set-mode pkt --set-rate 100 --set-burst 100To work around this issue, let the CPU bound IGMP packet hit the following rule and change the policer rate to a desired value for IGMP packets: -A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police --set-mode pkt --set-rate 100 --set-burst 100Typically, the destination MAC address 01:00:5e:xx:xx:xx is used only for PIM/IGMP control and data stream packets. However, this workaround cannot handle data stream multicast packets that are not TCP/UDP; this is not typically done. | 3.6.2-3.7.12 | |
| CM-21785 | The source address of the ICMPv6 time exceeded message (traceroute hop) is sourced from the wrong VRF when the traceroute target resides on the same switch but in a different VRF. | 3.6.2-3.7.12 | |
| CM-21769 | On the Mellanox switch, GRE tunneling does not work if the tunnel source is configured on an SVI interface. If the tunnel source is configured on a physical switch port, then tunneling works as expected. | 3.6.1-3.7.12 | |
| CM-21678 | On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty: cumulus@switch:~$ netq show sensors temp changes | grep absent | grep -v psu P2Leaf01 temp9 networking asic die temp sensor absent 43 105 100 5 Unable to find driver path: /cumulu Add 7d:22h:1m:41s P2Leaf01 temp6 networking asic die temp sensor absent 45 105 100 5 Unable to find driver path: /cumulu Add 7d:22h:1m:41s P2Leaf01 temp6 networking asic die temp sensor absent 47 105 100 5 Unable to read temp4_highest Add 9d:23h:26m:6s P2Leaf01 temp6 networking asic die temp sensor absent 45 105 100 5 Unable to read temp4_highest Add 14d:22h:46m:45s This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response. | 3.5.3-3.7.12 | |
| CM-21667 | FRR does not add BGP ttl-security to either the running configuration or to the /etc/frr/frr.conf file when configured on a peer group instead of a specific neighbor.To work around this issue, add ttl-security to individual neighbors instead of the peer group. | 3.6.1-3.7.12 | |
| CM-21379 | If a primary route becomes unavailable (for example, you run ifdown on the switch port), the backup route remains inactive and is not installed into FIB.To work around this issue, configure routes as ECMP: cumulus@switch:~$ net del routing route 4.1.1.0/24 1.1.1.1 10 cumulus@switch:~$ net add routing route 4.1.1.0/24 1.1.1.1 cumulus@switch:~$ net commit | 3.5.3-3.7.12 | |
| CM-21373 | Debian issued the following security advisory, DSA-4231-1, which affects the libgcrypt20 package. This advisory applies only to the the Debian Stretch release. Debian Jessie, upon which Cumulus Linux 3.0 - 3.6.2 is based, is vulnerable. CVE-2018-0495 It was discovered that Libgcrypt is prone to a local side-channel attack allowing recovery of ECDSA private keys. For the stable distribution (stretch), this problem has been fixed in version 1.7.6-2+deb9u3. We recommend that you upgrade your libgcrypt20 packages. For the detailed security status of libgcrypt20, refer to its security tracker page at: https://security-tracker.debian.org/tracker/libgcrypt20 | 3.6.2-3.7.10 | 3.7.11-3.7.12 |
| CM-21332 | When two VLAN subinterfaces are bridged to each other in a traditional mode bridge, switchd doesn’t assign a gport to the subinterface, even though a gport is expected for each VLAN subinterface.To work around this issue, you can do one of two things:
| 3.5.3-3.7.12 | |
| CM-21278 | The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment. | 3.5.3-3.7.10 | 3.7.11-3.7.12 |
| CM-21058 | The advertised routes list may be empty for an EVPN peering even though the remote switch reports received routes. | 3.6.0-3.7.12 | |
| CM-21055 | On the Mellanox switch, the destination MAC address of ERSPAN GRE packets is set to all zeros; therefore, the first transit switch might drop packets. | 3.6.0-3.7.12 | |
| CM-20813 | Span rules matching the out-interface as a bond do not mirror packets. | 3.6.0-3.7.12 | |
| CM-20693 | In NCLU, you can only set the community number in a route map. You cannot set other community options such as no-export, no-advertise, or additive.This is a known limitation in network-docopt and is documented in the Cumulus Linux user guide. | 3.5.1-3.7.12 | |
| CM-20534 | The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.10 | 3.7.11-3.7.12 |
| CM-20508 | The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. | 3.5.3-3.7.12 | |
| CM-20480 | The python-crypto package, which is not installed by default on Cumulus Linux, but is present in the repository to be installed, has the following security vulnerability in the version available for Cumulus Linux 3.x: CVE-2018-6594: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto’s ElGamal implementation. More information at https://security-tracker.debian.org/tracker/CVE-2018-6594 . | 3.0.0-3.7.12 | |
| CM-20132 | On Trident2 switches running 802.3x regular link pause, pause frames are accounted in HwIfInDiscards counters and are dropped instead of processed. | 3.5.2-3.7.10 | 3.7.11-3.7.12 |
| CM-20033 | The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down. | 3.5.2-3.7.12 | |
| CM-19788 | If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict.To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. | 3.5.0-3.7.12 | |
| CM-19724 | PIM and MSDP entries are set to the internal COS value of 6 so they are grouped together with the bulk traffic priority group in the default traffic.conf file. However, PIM, IGMP, and MSDP are considered control-plane and should be set to the internal COS value of 7. | 3.5.2-3.7.12 | |
| CM-19454 | When you use NCLU to bring a bond admin down (net add bond <bond> link down), the bond interface goes into admin down state but the switch ports enslaved to the bond remain UP. If you are using bond-lacp-bypass-allow or balance-xor mode, the host might continue to send traffic. This traffic will be dropped because although the bond slaves are UP, they are not members of the bridge.To work around this issue, use the sudo ifdown <bondname> command. | 3.5.0-3.7.12 | |
| CM-18727 | On the Mellanox SN-2100 switch, unicast packets are counted in multicast queue counters. | 3.4.3-3.7.10 | 3.7.11-3.7.12 |
| CM-17934 | FRR tracks interface speed based on the value it learns from the Linux kernel for that interface. If the interface speed changes, FRR does not update its interface speed cache. This can lead to issues for routing protocols that derive metrics from interface speed as the cost can become out of sync with the interface speed. To work around this issue, manually define the routing protocol metric for these interfaces or restart FRR. | 3.7.6-3.7.12 | |
| CM-17557 | When sFlow is enabled, some sampled packets, such as IPMC, are forwarded twice (in the ASIC and then again through the kernel networking stack). | 3.4.0-3.7.12 | |
| CM-17494 | In certain cases, a peer device sends an ARP request from a source IP address that is not on the connected subnet and the switch creates a STALE neighbor entry. Eventually, the switch attempts to keep the entry fresh and sends ARP requests to the host. If the host responds, the switch has REACHABLE neighbor entries for hosts that are not on the connected subnet. To work around this issue, change the value of arp_ignore to 2. See Default ARP Settings in Cumulus Linux for more information. | 3.3.2-3.7.12 | |
| CM-16855 | If a two nodes on both sides of a link change from auto-negotiation off to auto-negotiation on for both sides during a short interval (around one second), the link might start flapping or stay down.To work around this issue and stop the flapping, turn the link down on the switch with the command ifdown swpX, wait a few seconds, then bring the link back up with the command ifup swpX. Repeat this on the other side if necessary. | 3.3.2-3.7.12 | |
| CM-16571 | NCLU cannot manage rsyslog to addresses routed via a VRF. In Cumulus Linux 4.0.0 and later, management VRF is enabled by default. To work around this issue, update the /etc/network/interfaces file to disable management VRF. | 3.4.3-3.7.12 | |
| CM-16461 | After booting a Cumulus VX virtual machine running the VMware OVA image, sometimes messages from sensors appear, indicating that the “Avg state” is critical, with all values displayed as 100.0. A cl-support is generated. | 3.4.2-3.7.12 | |
| CM-15812 | Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. | 3.2.1-3.7.12 | |
| CM-15601 | On a Mellanox switch in an MLAG environment, a packet from a dually connected host might ingress on one switch but the MAC DA is destined to the router on the peer switch. The packet will traverse the peer link but is not excluded from port isolation (or egress mask) filtering. Similarly, an IP multicast packet might traverse the peer link and need to be routed. | 3.6.2-3.7.12 | |
| CM-15278 | During a link flap test, you might occasionally see a message similar to: warning: swp6: netlink: cannot set link swp6 down: <span class="error">[Errno 98]</span> Address already in use. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-15094 | Counter samples for an 80G bond (2 x 40G) exported from the switch show an interface speed (ifSpeed) of 14.464Gbps. | 3.2.0-3.7.12 | |
| CM-13316 | When you try to remove a VNI from a bridge using a regex match, the VNI is added back when you run the ifreload -a command. | 3.1.1-3.7.10 | 3.7.11-3.7.12 |
Fixed issues in 3.7.10
| Issue ID | Description | Affects |
|---|---|---|
| CM-26383 | After upgrading to Cumulus Linux 3.7.9 on a Broadcom switch, CPU generated traffic (such as ICMP, OSPF, ARP, and so on) egresses access ports with a 802.1Q header or interfaces with a bridge-pvid, with a VLAN ID of 0. Equipment from other vendors might drop this traffic. | 3.7.9 |
3.7.9 Release Notes
Open issues in 3.7.9
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-29740 | The exim4 package available for optional installation on Cumulus Linux 3.x has the following vulnerability:DLA-2213-1 / CVE-2020-12783: Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. The spa authentication driver is not enabled by default. Vulnerable: <= 4.84.2-2+deb8u6 Fixed: 4.84.2-2+deb8u7 | 3.0.0-3.7.12 | |
| CM-29556 | CVE-2020-11868: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp. This affects: ntp-4.2.8p12 (possibly earlier) and ntp-4.2.8p13 The fix for https://bugs.ntp.org/3445 introduced a bug whereby a system that is running ntp-4.2.8p12 or p13 that only has one unauthenticated time source can be attacked in a way that causes the victim’s next poll to its source to be delayed, for as long as the attack is maintained. http://support.ntp.org/bin/view/Main/NtpBug3592 gives the following mitigations if it is not possible to upgrade to a version with the fix:
| 3.0.0-3.7.12 | |
| CM-29518 | The following vulnerability affects the ruby2.1 package, which is installed by default: CVE-2020-10663: The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.1 has an unsafe object creation vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. Vulnerable: 2.1.5-2+deb8u9 Fixed: 2.1.5-2+deb8u10 | 3.0.0-3.7.12 | |
| CM-29484 | The following vulnerability affects libgd2/libgd3: CVE-2018-14553: gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled). Vulnerable: <= 2.1.0-5+deb8u13 Fixed: 2.1.0-5+deb8u14 | 3.0.0-3.7.12 | |
| CM-29483 | The following vulnerability affects imptool: CVE-2020-5208: It’s been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. Vulnerable: <= 1.8.14-4 Fixed: 1.8.14-4+deb8u1 | 3.0.0-3.7.12 | |
| CM-29284 | The following vulnerabilities affect git, which is available in the repository for optional installation: CVE-2020-5260: Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. CVE-2020-11008: Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. | 3.0.0-3.7.12 | |
| CM-29208 | The following vulnerability has been announced in ceph; the associated libraries librados2 and librbd1 are available in the Cumulus Linux 3 repository for optional installation. CVE-2020-1760: It was discovered that there was a header-splitting vulnerability in ceph, a distributed storage and file system. Vulnerable: <= 0.80.7-2+deb8u2 Fixed: 0.80.7-2+deb8u4 | 3.0.0-3.7.12 | |
| CM-29048 | The following vulnerability exists in the ruby2.1 package: CVE-2016-2338: An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer “head” allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow Vulnerable: <= 2.1.5-2+deb8u8 Fixed: 2.1.5-2+deb8u9 | 3.0.0-3.7.12 | |
| CM-29040 | The following issue has been found in e2fsprogs, a package that contains ext2/ext3/ext4 file system utilities:CVE-2019-5188: A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. | 3.0.0-3.7.12 | |
| CM-28993 | The following security vulnerability has been announced that affects the libicu52 package: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. Vulnerable: <= 52.1-8+deb8u7 Fixed: 52.1-8+deb8u8 | 3.0.0-3.7.12 | |
| CM-28992 | The following security vulnerability has been announced: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. | 3.0.0-3.7.12 | |
| CM-28954 | The python-twisted-* packages, which are available for optional installation in Cumulus Linux but are not installed by default, were found to have the following security vulnerabilities: CVE-2020-10808: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request. CVE-2020-10809: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request. | 3.0.0-3.7.12 | |
| CM-28944 | A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted. To work around this issue, reenter the redistribute <connected\|static> route-map <route-map-name> statement in the configuration. | 3.6.2-3.7.12 | |
| CM-28938 | When you install an ACL LOG/DROP rule on a layer 3 ingress interface that is a member of a VRF, traffic that matches this rule is not logged and is still forwarded. To work around this issue, apply the ACL LOG/DROP rule to the VRF device itself or to the layer 2 VNI. | 3.7.6-3.7.12 | |
| CM-28867 | The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12 | |
| CM-28816 | The following security advisory has been announced for bash: CVE-2019-18276 Qualys scan QID 372268 setuid vulnerability When bash or bash scripts are run setuid, bash is supposed to drop privileges, but does so incorrectly, so that an attacker with command access to the shell can use enable -f for runtime loading of a new builtin that calls setuid() to regain dropped privileges.To work around this issue, do not make bash or bash scripts setuid. | 3.0.0-3.7.12 | |
| CM-28811 | The following security vulnerability affects the libvpx1 library:CVE-2020-0034: It was discovered that there was an out-of-bounds buffer read vulnerability in libvpx, a library implementing the VP8 & VP9 videocodecs. | 3.0.0-3.7.12 | |
| CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.12 | |
| CM-28655 | When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.6.1-3.7.12 | |
| CM-28488 | The following CVEs were announced that affect the cron package. All of these require untrusted local user access.CVE-2017-9525 is a local user privilege escalation attack: In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs. CVE-2019-9704, CVE-2019-9705, CVE-2019-9706 are local user denial of service attacks. Note: the fix for CVE-2019-9705 imposes a limitation on the length of a crontab file (the vulnerability was that an unlimited size crontab file could cause excessive memory consumption). https://security-tracker.debian.org/tracker/DLA-1723-1 | 3.0.0-3.7.12 | |
| CM-28487 | The following CVE was announced for rsyslog: CVE-2019-17041 CVE-2019-17042 rsyslogd, when receiving remote log messages and using optional pmaixforwardedfrom or pmcisconames parser modules (not enabled by default on Cumulus Linux), is vulnerable to CVE-2019-17041 and CVE-2019-17042 where malicious messages that appear to be from AIX or Cisco respectively may be caused to skip sanity checks, resulting in incorrect negative lengths causing heap overflows.Do not enable (with $UDPServerRun or $InputTCPServerRun) receiving syslog messages from other hosts by the network. Also, do not enable (with $ModLoad) the vulnerable parsers pmaixforwardedfrom or pmcisconames.<br/>The default /etc/rsyslog.conf file on Cumulus Linux does NOT enable $UDPServerRun or $InputTCPServerRun, so the vulnerability is not network exploitable in the default configuration. In addition, the vulnerable parsers are not enabled in the default configuration. | 3.0.0-3.7.12 | |
| CM-28486 | The following vulnerability has been found in the libgcrypt20 cryptographic library. CVE-2019-13627: there was a ECDSA timing attack. For more information, see https://www.debian.org/lts/security/2020/dla-1931-2.en.html Vulnerable: 1.6.3-2+deb8u7 Fixed: 1.6.3-2+deb8u8 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28485 | The following vulnerability affects libxml2: CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c has a memory leak related to newDoc->oldNs. This can lead to a denial of service. For more information, see https://www.debian.org/lts/security/2019/dla-2048.en.html . Vulnerable: 2.9.1+dfsg1-5+deb8u7 Fixed: 2.9.1+dfsg1-5+deb8u8 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28484 | The following vulnerability affects libbsd, a package containing utility functions from BSD systems. CVE-2016-2090: In function fgetwln() an off-by-one error could triggers a heap buffer overflow. For more information, see https://www.debian.org/lts/security/2019/dla-2052.en.html . Vulnerable: 0.7.0-2 Fixed: 0.7.0-2+deb8u1 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28393 | On the Dell S5232F-ON switch, EVPN and dynamic VRF route leaking results in the CPU forwarding traffic to newly-learned type-2 routes. To work around this issue, restart FRR. | 3.7.9-3.7.12 | |
| CM-28374 | When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-3.7.12 | |
| CM-28224 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2019-15890: libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. Vulnerable: <= 2.1+dfsg-12+deb8u11 Fixed: 2.1+dfsg-12+deb8u12 | 3.0.0-3.7.10 | 3.7.11-3.7.12 |
| CM-28223 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-1711: block: iscsi: OOB heap access via an unexpected response of iSCSI Server | 3.0.0-3.7.12 | |
| CM-28222 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-7039: tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code. Vulnerable: <= 2.1+dfsg-12+deb8u12 Fixed: 2.1+dfsg-12+deb8u13 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28219 | The following vulnerability affects sudo, which is installed by default on Cumulus Linux. It is potentially exploitable on Cumulus Linux if pwfeedback (which is NOT enabled by default) is enabled in the /etc/sudoers file. CVE-2019-18634: In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c. For more information, refer to: https://security-tracker.debian.org/tracker/source-package/sudo https://security-tracker.debian.org/tracker/CVE-2019-18634 https://www.sudo.ws/alerts/pwfeedback.html Vulnerable: <= 1.8.10p3-1+deb8u6 Fixed: 1.8.10p3-1+deb8u7 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28160 | On the Broadcom Trident3 switch with DHCP relay, where the DHCP server is reachable through the EVPN overlay, DHCP discover packets forwarded to the CPU might appear corrupt and might not get forwarded. | 3.7.9-3.7.12 | |
| CM-28091 | Two security issues were found in the Python interface to the apt package manager, which is installed by default on Cumulus Linux; package downloads from unsigned repositories were incorrectly rejected (CVE-2019-15796) and the hash validation relied on MD5 (CVE-2019-15795). For more information, refer to https://security-tracker.debian.org/tracker/source-package/python-apt Vulnerable: 0.9.3.12 Fixed: 0.9.3.13 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28076 | After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom --init command. | 3.6.0-3.7.12 | |
| CM-28016 | On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. | 3.7.7-3.7.11 | 3.7.12 |
| CM-28007 | When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 | 3.7.12 |
| CM-27947 | Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. | 3.7.0-3.7.11 | 3.7.12 |
| CM-27937 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 One of the listed vulnerabilities is still present in the latest upstream version 2.1+dfsg-12+deb8u12 (the others have been fixed): CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. https://security-tracker.debian.org/tracker/CVE-2017-15124 | 3.0.0-3.7.12 | |
| CM-27924 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.26.dfsg1-13+deb8u1 Fixed: 2.1.26.dfsg1-13+deb8u2 | 3.0.0-3.7.11 | 3.7.12 |
| CM-27855 | The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. | 3.7.0-3.7.11 | 3.7.12 |
| CM-27793 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.27+dfsg-1 Fixed: 2.1.27+dfsg-1+deb10u1 | 3.0.0-3.7.12 | |
| CM-27764 | On the EdgeCore AS7326-56X switch, eth0 and swp1 use the same MAC address. | 3.7.9-3.7.11 | 3.7.12 |
| CM-27698 | SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.12 | |
| CM-27683 | The following CVEs were announced that affect the Linux kernel: CVE-2019-12378: An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-12381: An issue was discovered in ip_ra_control in net/ipv4/ip_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-15239: In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation. CVE-2019-19062: A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042. CVE-2019-19537: In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID-303911cfc5b9. This affects drivers/usb/core/file.c. CVE-2019-20054: In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e. | 3.0.0-3.7.11 | 3.7.12 |
| CM-27646 | Several vulnerabilities have been discovered in Git, a fast, scalable, distributed revision control system, which is available in the Cumulus Linux 3.x repositories for optional installation. CVE-2019-1348: export-marks is insecure, fix is to disable by default. CVE-2019-1349: .git / git~1 filename vulnerability on NTFS CVE-2019-1352: .git vulnerability with NTFS Alternate Streams Accesses CVE-2019-1353: NTFS filesystem protection should be on by default CVE-2019-1387: dubiously-nested submodule git directories should be disallowed CVE-2019-19604: submodule update repository code execution vulnerability Vulnerable: <= 2.1.4-2.1+deb8u7 Fixed: 2.1.4-2.1+deb8u8 | 3.0.0-3.7.12 | |
| CM-27628 | The following security vulnerabilities have been announced in the nss/libnss3 library, which is not installed by default but is available in the repository: CVE-2019-11745: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate CVE-2019-17007: nss: Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may crash with a NULL deref leading to DoS See https://security-tracker.debian.org/tracker/source-package/nss for more information. Vulnerable: <= 3.26-1+debu8u7 Fixed: 3.26-1+debu8u9 | 3.0.0-3.7.10 | 3.7.11-3.7.12 |
| CM-27457 | If you delete, then re-add a PBR policy on an interface, the configured PBR policy is not programmed in the kernel or switchd. | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-27456 | After making a series of PBR configuration changes using NCLU commands, the stale PBR entry is still present in the kernel. | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-27351 | On rare occasions, after rebooting the MLAG secondary switch, one MLAG device might see the peer as down, which can cause traffic disruption to connected hosts. | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-27299 | The protocol daemon bgpd crashes when a link/neighbor flaps if static routes pointing to Null0 are advertising through BGP.To work around this issue, reboot the switch, then remove the static routes or stop advertising these routes. | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-27295 | IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.[ip6tables] | 3.7.2-3.7.11 | 3.7.12 |
| CM-27279 | When ECMP routes have both VXLAN (symmetric routing) and non-VXLAN paths, the non-VXLAN path is incorrectly installed in the RIB and FIB to point across VXLAN. The non-VXLAN next-hop will be installed as an offload entry in the neighbor table (ip neigh show) with a mac address of 00:00:00:00:00:00. | 3.7.3-3.7.12 | |
| CM-27233 | If you change multiple BGP or BFD timers in the /etc/frr/frr.conf file and then reload FRR, a traceback is encountered and the change does not take effect. | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-27174 | The ospfd daemon might crash with the following kernel trace:2019-11-06T23:00:08.261749+09:00 cumulus ospfd[5339]: Assertion ‘node’ failed in file ospfd/ospf_packet.c, line 671, function ospf_write | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-27120 | When an interface flap occurs, numbered IPv6 BGP sessions might fail to establish. To work around this issue, run the ip -6 route flush cache <IPv6-address> command to flush the IPv6 route cache. | 3.7.9-3.7.11 | 3.7.12 |
| CM-27096 | On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10 | 3.7.11-3.7.12 |
| CM-27094 | On the Delta AG9032v1 switch, smonctl and sensors report inaccurate PSU current and power. | 3.5.0-3.7.12 | |
| CM-27025 | On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. | 3.7.2-3.7.10 | 3.7.11-3.7.12 |
| CM-26968 | When networking fails to start properly, an MLAG memory leak occurs, which might cause memory issues. | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-26954 | In the default VRF, VRRP might crash and stay in an initialize state. As a result, VRRP multicast traffic is not generated. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26921 | If you delete an undefined bond, then add a bond slave, the net commit command fails. | 3.7.9-3.7.12 | |
| CM-26913 | FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:sudo sh -c “printf ‘interface 50\nvrf TEST description L3 routing interface\n’ » /etc/frr/frr.conf" should be: sudo sh -c “printf ‘interface 50 vrf TEST\ndescription L3 routing interface\n’ » /etc/frr/frr.conf" To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. | 3.7.9-3.7.12 | |
| CM-26894 | The neighmgrd service does not ignore neighbors on reserved devices (lo and management devices). This issue is not seen when management VRF is enabled. | 3.7.8-3.7.11 | 3.7.12 |
| CM-26875 | After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. | 3.7.9-3.7.12 | |
| CM-26838 | You might experience a bgpd memory usage increase and significant update exchanges due to host moves between VTEPs. | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-26829 | Frames received with a VLAN tag of 0 on an interface configured as a bridge port and forwarded to the CPU for processing might appear tagged with the native VLAN when viewed with tcpdump. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26769 | Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26691 | BGP is configured with soft reconfiguration-in for its peers, which is not working correctly and causes routes to have an unexpected label. As a result, transit traffic is not forwarded by the switch. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26657 | When you install a large number of new rules with nonatomic mode enabled, there is a chance that you install more rules than the number of available slots in the slice, which results in the slice being completely wiped and reinstalled. This causes a large drop increase, including to cpu0, and might cause a major outage by dropping all BGP sessions. | 3.6.1-3.7.10 | 3.7.11-3.7.12 |
| CM-26655 | If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:net add time ntp server 1.2.3.4 iburst If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. | 3.7.9-3.7.12 | |
| CM-26599 | Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. | 3.7.9-3.7.12 | |
| CM-26595 | The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. | 3.7.9-3.7.12 | |
| CM-26525 | When an MLAG peerlink frequently alternates states between learning and blocking, an excessive number of TCP sessions might be created, which results in the following error display:OSError: [Errno 24] Too many open files | 3.6.2-3.7.10 | 3.7.11-3.7.12 |
| CM-26523 | Package: hostapd CVE ID: CVE-2019-13377 CVE-2019-16275 Two vulnerabilities were found in the WPA protocol implementation found in wpa_supplication (station) and hostapd (access point). CVE-2019-13377 A timing-based side-channel attack against WPA3’s Dragonfly handshake when using Brainpool curves could be used by an attacker to retrieve the password. CVE-2019-16275 Insufficient source address validation for some received Management frames in hostapd could lead to a denial of service for stations associated to an access point. An attacker in radio range of the access point could inject a specially constructed unauthenticated IEEE 802.11 frame to the access point to cause associated stations to be disconnected and require a reconnection to the network. Fixed version: 1:2.8.0-cl4u3 | 3.7.0-3.7.10 | 3.7.11-3.7.12 |
| CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.12 | |
| CM-26450 | Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-26448 | Traffic sent to the SVI IP address of a switch might be lost if all of the following conditions are met:
To workaround this issue, restart switchd. | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-26437 | NCLU crashes when you run the net add interface storage-optimized pfc command because non-ascii quotes exist in the datapath.conf file.To work around this issue, manually edit the /usr/lib/python2.7/dist-packages/cumulus/__chip_config/mlx/datapath.conf file and replace the non-ascii single quotes with ascii single quotes (standard single quote on the keyboard). | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.12 | |
| CM-26412 | Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. | 3.7.9-3.7.12 | |
| CM-26383 | After upgrading to Cumulus Linux 3.7.9 on a Broadcom switch, CPU generated traffic (such as ICMP, OSPF, ARP, and so on) egresses access ports with a 802.1Q header or interfaces with a bridge-pvid, with a VLAN ID of 0. Equipment from other vendors might drop this traffic. | 3.7.9 | 3.7.10-3.7.12 |
| CM-26372 | FRR crashes when adding an IPv6 neighbor with extended-nexthop capability. | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-26351 | After you remove a subinterface, the BGP session stays in a Connect state. | 3.7.8-3.7.11 | 3.7.12 |
| CM-26308 | An interface alias configured outside FRR using iproute2 is imported into the FRR running configuration and overrides the internal description. After an FRR reload, this causes FRR to delete the interface alias in an inefficient way. Depending on how many interfaces with aliases you have configured, this can cause a FRR reload to time out.To work around this issue, remove the interface alias description from iproute2. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26288 | On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.12 | |
| CM-26272 | On the Mellanox Spectrum switch, a route withdrawal might cause the associated next hop neighbor entry to be deleted in hardware but remain in the kernel. This can cause traffic going through the directly connected route to the removed neighbor entry to be forwarded to the CPU. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26256 | The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. | 3.7.8-3.7.12 | |
| CM-26255 | On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26252 | The following CVEs were announced that affect the ghostscript package: CVE ID : CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817 It was discovered that various procedures in Ghostscript, the GPL PostScript/PDF interpreter, do not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.7.0-3.7.10 | 3.7.11-3.7.12 |
| CM-26241 | On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. | 3.7.6-3.7.11 | 3.7.12 |
| CM-26230 | When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. | 3.7.8-3.7.12 | |
| CM-26225 | On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:2019-09-05T05:15:17.246597+00:00 hp-6712-03 decode-syseeprom: Unable to find eeprom at /sys/bus/i2c/devices/11-0050/eeprom for psu2 | 3.7.9-3.7.12 | |
| CM-26217 | NCLU does not allow you to configure OSPF NSSAs. For example:cumulus@switch:~$ net add ospf area 0.0.0.1 nssa To work around this issue, use FRR instead. For example: switch# configure terminal | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-26181 | ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).-A FORWARD -i swp+ -j LOG You can now install such rules with swp+. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-26179 | If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error:ERROR: ‘ascii’ codec can’t encode character u’\xe9’ in position 3: ordinal not in range(128) | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-26169 | Cumulus Linux does not map QinQ packets to VXLANs in a configuration with a VLAN-aware bridge and MLAG on the Trident3 platform. | 3.7.9-3.7.10 | 3.7.11-3.7.12 |
| CM-26158 | On the Mellanox switch, UFT profiles are unable to support the documented capacity for routes to addresses that are more than 64 bits in length. The listed capacities assume 64-bit destination IP addresses. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26147 | On the EdgeCore AS4610 switch, the ping command fails unless you run the command with sudo.To work around this issue, run the following commands: cumulus@switch:~$ sudo setcap cap_net_raw+ep /usr/share/mgmt-vrf/bin/ping Run the following command to verify the workaround:
You should see the following output:
| 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26146 | clagd memory consumption increases under certain unknown conditions. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26139 | Selective ERSPAN does not work when you specify a bridge port. | 3.7.6-3.7.12 | |
| CM-26138 | You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:-A FORWARD -i swp5 -s 00:25:90:b2:bd:9d -d 50:6b:4b:96:c4:04 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64 | 3.7.6-3.7.12 | |
| CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:-A FORWARD -i vni10 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64 | 3.7.6-3.7.12 | |
| CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.12 | |
| CM-26126 | Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.12 | |
| CM-26024 | On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. | 3.7.7-3.7.12 | |
| CM-25973 | After a remote VTEP peer link goes down, the tunnel destination IP address might be incorrect in hardware, which might cause loss of overlay communication between VTEPs. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-25955 | Lenovo switches do not send or receive LLDP on eth0 interfaces. | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-25923 | The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. | 3.7.8-3.7.12 | |
| CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.12 | |
| CM-25859 | The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. | 3.7.7-3.7.12 | |
| CM-25824 | NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.12 | |
| CM-25796 | Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:ifdown vlan123 ; sleep 2 ; ifup vlan123 You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. | 3.7.5-3.7.12 | |
| CM-25794 | Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.12 | |
| CM-25766 | On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. | 3.7.7-3.7.12 | |
| CM-25747 | When transitioning from a down state to an up state due to peerlink failure and recovery, MLAG does not start the initDelay timer before trying to bring everything back up. | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:cumulus@switch:~$ net add bridge mybridge vlan-protocol 802.1ad | 3.7.6-3.7.12 | |
| CM-25718 | IF-MIB::ifHCInOctets reports significantly lower values than reported by interface counters seen elsewhere. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25694 | If a packet is policed by ebtables, it does not increment an ACL drop on the ingress interface. Instead, it increments the TDBGC3/6 drop counter to the CPU. | 3.7.6-3.7.12 | |
| CM-25693 | After you issue the NCLU net del bgp vrf <vrf> autonomous-system <AS> command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-25672 | snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. | 3.7.4-3.7.10 | 3.7.11-3.7.12 |
| CM-25665 | On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur:
| 3.7.5-3.7.11 | 3.7.12 |
| CM-25641 | If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl.To work around this issue, power cycle the switch. | 3.7.6-3.7.12 | |
| CM-25640 | When you configure the switch to send an EAP request with the net add dot1x send-eap-request-id command, the switch ignores re-authentication attempts and does not send back an EAPol. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25505 | In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result. In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example:
| 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25447 | When you define a trap destination using @mgmt, snmpd indicates that the network is unreachable even though the IP address is reachable in the management VRF.To work around this issue, remove @mgmt vrf references in the /etc/snmp/snmpd.conf file, stop snmpd, then start snmpd manually in the management VRF with the systemctl start snmpd@mgmt command. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25404 | hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. | 3.7.6-3.7.12 | |
| CM-25400 | If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. | 3.7.6-3.7.12 | |
| CM-25397 | When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. | 3.7.3-3.7.12 | |
| CM-25376 | When you generate a cl-support file, clagd.service prints log messages similar to the following:019-03-21T07:18:15.727581+00:00 leaf01 clagd[20912]: DumpThreadStacks - start 2019-03-21T07:18:15.728157+00:00 leaf01 clagd[20912]: #012thread: CollectSysInfo (140608446367488) 2019-03-21T07:18:15.735986+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 783, in __bootstrap 2019-03-21T07:18:15.736585+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 810, in __bootstrap_inner 2019-03-21T07:18:15.737045+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 763, in run 2019-03-21T07:18:15.737933+00:00 leaf01 clagd[20912]: file: /usr/sbin/clagd, line 930, in CollectSysInfoT 2019-03-21T07:18:15.739527+00:00 leaf01 clagd[20912]: file: /usr/sbin/clagd, line 187, in CollectSysInfo 2019-03-21T07:18:15.740540+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 621, in wait 2019-03-21T07:18:15.742293+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/dist-packages/clag/clagthread.py, line 48, in wait . . 2019-03-21T07:18:16.456061+00:00 leaf01 clagd[20912]: DumpThreadStacks - end | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25298 | The following CVEs were announced in a Debian Security Advisory that affects vim modelines. Package: vim and neovim CVE ID: CVE-2019-12735 Debian Bugs: 930020, 930024 getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim. For the detailed security status, refer to the security tracker page at: https://security-tracker.debian.org/tracker/CVE-2019-12735 https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12735.html https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md Cumulus Networks recommends that you disable modelines in the the vimrc file (set nomodeline) to use the securemodelines plugin or to disable modelineexpr (since patch 8.1.1366, Vim-only) to disallow expressions in modelines.To check if you have modelines enabled, open vim and enter: :set modeline? If vim returns nomodeline, you are not vulnerable. If you are vulnerable or you want to ensure your security with this issue, add these lines to your vimrc file:set modelines=0 set nomodeline modeline is enabled by default. Verify that you do not have any existing lines in .vimrc that set modelines or modeline. | 3.0.0-3.7.10 | 3.7.11-3.7.12 |
| CM-25001 | The following CVEs were announced in Debian Security Advisory DSA-444-1, DSA-4447-1 and affect the linux kernel and microcode. Package: linux CVE ID: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 Multiple researchers have discovered vulnerabilities in the way the Intel processor designs have implemented speculative forwarding of data filled into temporary microarchitectural structures (buffers). This flaw could allow an attacker controlling an unprivileged process to read sensitive information, including from the kernel and all other processes running on the system or cross guest/host boundaries to read host memory. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details. To fully resolve these vulnerabilities it is also necessary to install updated CPU microcode. Contact your hardware ndor for microcode uppdates. In addition, this update includes a fix for a regression causing deadlocks inside the loopback driver. Fixed in version 4.19.76-1+cl4u1 | 3.0.0-3.7.12 | |
| CM-24894 | The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. | 3.7.5-3.7.12 | |
| CM-24803 | On the Dell N3048EP-ON or the Delta AG6248 switch, when you execute the following command, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The Cumulus Linux image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new Cumulus Linux image.The workaround only works when an out-of-band network is present. | 3.7.6-3.7.12 | |
| CM-24799 | On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. | 3.7.5-3.7.12 | |
| CM-24751 | On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. | 3.7.3-3.7.12 | |
| CM-24703 | The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.12 | |
| CM-24686 | On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. | 3.7.3-3.7.12 | |
| CM-24652 | In an EVPN environment, the centralized MAC address is not installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN. This issue does not affect a pure distributed routing (symmetric or asymmetric) environment or a pure centralized routing environment. | 3.7.0-3.7.12 | |
| CM-24618 | If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:ERROR: No closing quotation See /var/log/netd.log for more details. | 3.6.1-3.7.12 | |
| CM-24473 | SNMP incorrectly requires engine ID specification. | 3.7.4-3.7.12 | |
| CM-24435 | When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect: net add routing route-map Proxy-ARP permit 25 match interface swp9-10 These commands are correct: net add routing route-map Proxy-ARP permit 25 match interface swp9 net add routing route-map Proxy-ARP permit 30 match interface swp10 | 3.7.2-3.7.12 | |
| CM-24426 | NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf <name> command just displays
Tab completion for the net add vrf <name> ip address <address> command works correctly. | 3.7.4-3.7.12 | |
| CM-24379 | On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.12 | |
| CM-24343 | The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. | 3.7.4-3.7.12 | |
| CM-24332 | On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. | 3.7.3-3.7.12 | |
| CM-24272 | When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface br0.100 switch(config-if)# vrrp 1 priority 110 switch(config-if)# vrrp 1 advertisement-interval switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24271 | On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface vlan100 switch(config-if)# vrrp 1 priority 110 switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24270 | Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface swp4 switch(config-if)# vrrp 1 version 2 switch(config-if)# no vrrp 1 preempt switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24262 | NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto <iface> lines exist. | 3.7.3-3.7.12 | |
| CM-24241 | When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:cumulus@switch:~$ net del bgp neighbor fabric peer-group ‘router bgp 65001’ configuration does not have ‘neighbor fabric peer-group’ | 3.7.2-3.7.12 | |
| CM-24222 | When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. | 3.7.0-3.7.12 | |
| CM-24035 | On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. | 3.7.2-3.7.12 | |
| CM-23825 | The net add interface <interface> ptm-enable command adds no ptm-enable for that interface in the frr.conf file.Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. | 3.7.2-3.7.12 | |
| CM-23792 | When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table.To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev <interface> command. | 3.7.0-3.7.12 | |
| CM-23696 | IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. | 3.7.2-3.7.12 | |
| CM-23665 | NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan <layer3-vni> bridge access <vlan>. This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.To restore connectivity, remove the VLAN ID from the bridge. | 3.7.2-3.7.12 | |
| CM-23661 | On the Mellanox switch, when you configure a GRE tunnel, the traffic behind the local tunnel endpoint destined through the GRE tunnel is software-forwarded. | 3.7.2-3.7.12 | |
| CM-23651 | In an EVPN symmetric routing configuration, when an IP address is frozen, kernel neighbor table information and kernel VRF routing table information about the frozen IP address might be out-of-sync. | 3.7.3-3.7.12 | |
| CM-23584 | When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. | 3.7.2-3.7.12 | |
| CM-23570 | On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. | 3.7.2-3.7.12 | |
| CM-23422 | portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. | 3.7.0-3.7.12 | |
| CM-23418 | For QSFP modules, the sudo ifdown command does not disable the Tx laser. | 3.7.2-3.7.12 | |
| CM-23417 | If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. | 3.7.0-3.7.12 | |
| CM-23397 | On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. | 3.6.2-3.7.12 | |
| CM-23125 | The OpenSSL package on Cumulus Linux 3.x has a vulnerability similar to CVE-2018-0734. (The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key). According to Debian upstream, this version “is not vulnerable [to CVE-2018-0734 exactly]. Nevertheless, there is a bug fix that futher reduces the amount of leaked timing information. It got no CVE on its own and introduced this vulnerability.“ Vulnerable on CL3: 1.0.1t-1+deb8u12 | 3.0.0-3.7.12 | |
| CM-23123 | When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. | 3.7.2-3.7.12 | |
| CM-23075 | There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:2018-11-10T23:35:30.992370-08:00 Dev dhcrelay: Listening on LPF/vlan.101/a0:00:00:00:00:51 2018-11-10T23:35:30.993472-08:00 Dev dhcrelay: Sending on LPF/vlan.101/a0:00:00:00:00:51 Eventually the dhcrelay service stops. | 3.7.1-3.7.12 | |
| CM-23021 | When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. | 3.7.1-3.7.12 | |
| CM-23016 | When FRR restarts, snmp<span class="error">[err]</span> dev/kmem: Permission denied error messages are recorded in the log file and SNMPd might crash periodically. | 3.7.5-3.7.10 | 3.7.11-3.7.12 |
| CM-23004 | The local fallback account authenticates using the local password when the RADIUS or TACACS service is up. The expected behavior is for this to fail and only succeed when the RADIUS OR TACACS server fails to respond. | 3.7.1-3.7.12 | |
| CM-22937 | NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation.To work around this issue, stop snmpd, remove the cache file, then restart snmpd. | 3.6.0-3.7.12 | |
| CM-22849 | When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur.This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. | 3.7.2-3.7.12 | |
| CM-22808 | When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. | 3.5.2-3.7.12 | |
| CM-22794 | The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. | 3.6.2-3.7.12 | |
| CM-22605 | On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0.To work around this issue:
| 3.5.3-3.7.10 | 3.7.11-3.7.12 |
| CM-22591 | CVE-2018-5391 (FragmentSmack) is a network vulnerability where an attacker can trigger time and calculation expensive fragment reassembly with specially crafted packets, leading to a denial of service. On a Cumulus Linux switch, the impact is limited to control plane and management plane traffic. Any control plane traffic coming in the front panel ports will be limited by existing policer ACLs. To work around this issue, create a file called /etc/sysctl.d/ip.conf and add these settings:net.ipv4.ipfrag_low_thresh = 196608 | 3.7.0-3.7.11 | 3.7.12 |
| CM-22583 | Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. | 3.6.0-3.7.12 | |
| CM-22554 | If you try to bring down several members of a bond remotely at the same time, the link state of one of the interfaces might not transition correctly to the down state; however, all links show down in hardware. | 3.6.2-3.7.12 | |
| CM-22538 | When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:/etc/frr/daemons was modified by another user. Despite this error, the change is made and the description is removed from the frr.conf file. | 3.6.2-3.7.10 | 3.7.11-3.7.12 |
| CM-22386 | The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. | 3.7.0-3.7.12 | |
| CM-22301 | For an unresolved address, the IPROUTER default policer rule has been modified to not match on packets exiting a TUNNEL and headed to the CPU to resolve the address via ARP. As a result, the following default rule no longer matches TUNNEL ingress packets.A $INGRESS_CHAIN –in-interface $INGRESS_INTF -m addrtype –dst-type IPROUTER -j POLICE –set-mode pkt –set-rate 400 –set-burst 100 These packets are now policed by catch all rules. To work around this issue, the VPORT value on a TRIDENT switch must be changed from binary 011 to 100. | 3.6.1-3.7.12 | |
| CM-22287 | On the EdgeCore AS7712 (Tomahawk) switch running in atomic mode, when a layer 3 ECMP path is brought down, traffic traversing the path stops working for about four seconds. When the switch is changed to non-atomic mode, the delay is less than one second. This issue is seen across OSPF and static ECMP routes. | 3.6.2-3.7.12 | |
| CM-22277 | On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-22274 | To ease interoperation with non-Cumulus devices, it is possible to configure the route-target import and export values under the layer 2 VNI EVPN configuration. The same configuration does not work for both layer 2 VNI and layer 3 VNIs. Set the EVPN address-family within the VNI context when configuring the route-target in the layer 2 VNI. Set the EVPN address-family without the VNI context when configuring the route-target in the layer 3 VNI. | 3.6.0-3.7.12 | |
| CM-22252 | On the Edgecore OMP-800, there is no Power Supply information from the sensor or from smonctl. The platform driver has support for the PSUs but this was not added to the sensors infrastructure.This is a known limitation on the OMP-800 platform. | 3.6.2-3.7.12 | |
| CM-22228 | On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.12 | |
| CM-22205 | If a user is in vtysh when FRR is restarted, the running configuration in that vtysh session shows empty. | 3.6.2-3.7.12 | |
| CM-22138 | When you run the NCLU net show system command or the NetQ netq inventory command on the Edgecore OMP-800 switch, the output does not show any port or chip information. | 3.6.2-3.7.12 | |
| CM-22041 | At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. | 3.4.3-3.7.12 | |
| CM-22020 | On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. | 3.7.0-3.7.12 | |
| CM-21927 | When running ifreload on Mellanox Spectrum devices, after updating an interface configuration, sometimes VLANs are not programmed into the hardware data plane. The Linux control plane looks normal but the VLAN has not been programmed into the hardware and packets that arrive for the VLAN might be dropped.To work around this issue, remove and re-add the affected VLANs from the port. | 3.5.3-3.7.12 | |
| CM-21898 | On a Trident3 switch, IGMP packets are not policed by the police rule in the 00control ACL file. The packets are policed by the catchall policer in the 99control ACL file instead.-A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police --set-mode pkt --set-rate 100 --set-burst 100To work around this issue, let the CPU bound IGMP packet hit the following rule and change the policer rate to a desired value for IGMP packets: -A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police --set-mode pkt --set-rate 100 --set-burst 100Typically, the destination MAC address 01:00:5e:xx:xx:xx is used only for PIM/IGMP control and data stream packets. However, this workaround cannot handle data stream multicast packets that are not TCP/UDP; this is not typically done. | 3.6.2-3.7.12 | |
| CM-21785 | The source address of the ICMPv6 time exceeded message (traceroute hop) is sourced from the wrong VRF when the traceroute target resides on the same switch but in a different VRF. | 3.6.2-3.7.12 | |
| CM-21769 | On the Mellanox switch, GRE tunneling does not work if the tunnel source is configured on an SVI interface. If the tunnel source is configured on a physical switch port, then tunneling works as expected. | 3.6.1-3.7.12 | |
| CM-21678 | On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty: cumulus@switch:~$ netq show sensors temp changes | grep absent | grep -v psu P2Leaf01 temp9 networking asic die temp sensor absent 43 105 100 5 Unable to find driver path: /cumulu Add 7d:22h:1m:41s P2Leaf01 temp6 networking asic die temp sensor absent 45 105 100 5 Unable to find driver path: /cumulu Add 7d:22h:1m:41s P2Leaf01 temp6 networking asic die temp sensor absent 47 105 100 5 Unable to read temp4_highest Add 9d:23h:26m:6s P2Leaf01 temp6 networking asic die temp sensor absent 45 105 100 5 Unable to read temp4_highest Add 14d:22h:46m:45s This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response. | 3.5.3-3.7.12 | |
| CM-21667 | FRR does not add BGP ttl-security to either the running configuration or to the /etc/frr/frr.conf file when configured on a peer group instead of a specific neighbor.To work around this issue, add ttl-security to individual neighbors instead of the peer group. | 3.6.1-3.7.12 | |
| CM-21379 | If a primary route becomes unavailable (for example, you run ifdown on the switch port), the backup route remains inactive and is not installed into FIB.To work around this issue, configure routes as ECMP: cumulus@switch:~$ net del routing route 4.1.1.0/24 1.1.1.1 10 cumulus@switch:~$ net add routing route 4.1.1.0/24 1.1.1.1 cumulus@switch:~$ net commit | 3.5.3-3.7.12 | |
| CM-21373 | Debian issued the following security advisory, DSA-4231-1, which affects the libgcrypt20 package. This advisory applies only to the the Debian Stretch release. Debian Jessie, upon which Cumulus Linux 3.0 - 3.6.2 is based, is vulnerable. CVE-2018-0495 It was discovered that Libgcrypt is prone to a local side-channel attack allowing recovery of ECDSA private keys. For the stable distribution (stretch), this problem has been fixed in version 1.7.6-2+deb9u3. We recommend that you upgrade your libgcrypt20 packages. For the detailed security status of libgcrypt20, refer to its security tracker page at: https://security-tracker.debian.org/tracker/libgcrypt20 | 3.6.2-3.7.10 | 3.7.11-3.7.12 |
| CM-21332 | When two VLAN subinterfaces are bridged to each other in a traditional mode bridge, switchd doesn’t assign a gport to the subinterface, even though a gport is expected for each VLAN subinterface.To work around this issue, you can do one of two things:
| 3.5.3-3.7.12 | |
| CM-21278 | The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment. | 3.5.3-3.7.10 | 3.7.11-3.7.12 |
| CM-21058 | The advertised routes list may be empty for an EVPN peering even though the remote switch reports received routes. | 3.6.0-3.7.12 | |
| CM-21055 | On the Mellanox switch, the destination MAC address of ERSPAN GRE packets is set to all zeros; therefore, the first transit switch might drop packets. | 3.6.0-3.7.12 | |
| CM-20813 | Span rules matching the out-interface as a bond do not mirror packets. | 3.6.0-3.7.12 | |
| CM-20693 | In NCLU, you can only set the community number in a route map. You cannot set other community options such as no-export, no-advertise, or additive.This is a known limitation in network-docopt and is documented in the Cumulus Linux user guide. | 3.5.1-3.7.12 | |
| CM-20534 | The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.10 | 3.7.11-3.7.12 |
| CM-20508 | The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. | 3.5.3-3.7.12 | |
| CM-20480 | The python-crypto package, which is not installed by default on Cumulus Linux, but is present in the repository to be installed, has the following security vulnerability in the version available for Cumulus Linux 3.x: CVE-2018-6594: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto’s ElGamal implementation. More information at https://security-tracker.debian.org/tracker/CVE-2018-6594 . | 3.0.0-3.7.12 | |
| CM-20132 | On Trident2 switches running 802.3x regular link pause, pause frames are accounted in HwIfInDiscards counters and are dropped instead of processed. | 3.5.2-3.7.10 | 3.7.11-3.7.12 |
| CM-20033 | The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down. | 3.5.2-3.7.12 | |
| CM-19788 | If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict.To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. | 3.5.0-3.7.12 | |
| CM-19724 | PIM and MSDP entries are set to the internal COS value of 6 so they are grouped together with the bulk traffic priority group in the default traffic.conf file. However, PIM, IGMP, and MSDP are considered control-plane and should be set to the internal COS value of 7. | 3.5.2-3.7.12 | |
| CM-19454 | When you use NCLU to bring a bond admin down (net add bond <bond> link down), the bond interface goes into admin down state but the switch ports enslaved to the bond remain UP. If you are using bond-lacp-bypass-allow or balance-xor mode, the host might continue to send traffic. This traffic will be dropped because although the bond slaves are UP, they are not members of the bridge.To work around this issue, use the sudo ifdown <bondname> command. | 3.5.0-3.7.12 | |
| CM-18727 | On the Mellanox SN-2100 switch, unicast packets are counted in multicast queue counters. | 3.4.3-3.7.10 | 3.7.11-3.7.12 |
| CM-17934 | FRR tracks interface speed based on the value it learns from the Linux kernel for that interface. If the interface speed changes, FRR does not update its interface speed cache. This can lead to issues for routing protocols that derive metrics from interface speed as the cost can become out of sync with the interface speed. To work around this issue, manually define the routing protocol metric for these interfaces or restart FRR. | 3.7.6-3.7.12 | |
| CM-17557 | When sFlow is enabled, some sampled packets, such as IPMC, are forwarded twice (in the ASIC and then again through the kernel networking stack). | 3.4.0-3.7.12 | |
| CM-17494 | In certain cases, a peer device sends an ARP request from a source IP address that is not on the connected subnet and the switch creates a STALE neighbor entry. Eventually, the switch attempts to keep the entry fresh and sends ARP requests to the host. If the host responds, the switch has REACHABLE neighbor entries for hosts that are not on the connected subnet. To work around this issue, change the value of arp_ignore to 2. See Default ARP Settings in Cumulus Linux for more information. | 3.3.2-3.7.12 | |
| CM-16855 | If a two nodes on both sides of a link change from auto-negotiation off to auto-negotiation on for both sides during a short interval (around one second), the link might start flapping or stay down.To work around this issue and stop the flapping, turn the link down on the switch with the command ifdown swpX, wait a few seconds, then bring the link back up with the command ifup swpX. Repeat this on the other side if necessary. | 3.3.2-3.7.12 | |
| CM-16571 | NCLU cannot manage rsyslog to addresses routed via a VRF. In Cumulus Linux 4.0.0 and later, management VRF is enabled by default. To work around this issue, update the /etc/network/interfaces file to disable management VRF. | 3.4.3-3.7.12 | |
| CM-16461 | After booting a Cumulus VX virtual machine running the VMware OVA image, sometimes messages from sensors appear, indicating that the “Avg state” is critical, with all values displayed as 100.0. A cl-support is generated. | 3.4.2-3.7.12 | |
| CM-15812 | Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. | 3.2.1-3.7.12 | |
| CM-15601 | On a Mellanox switch in an MLAG environment, a packet from a dually connected host might ingress on one switch but the MAC DA is destined to the router on the peer switch. The packet will traverse the peer link but is not excluded from port isolation (or egress mask) filtering. Similarly, an IP multicast packet might traverse the peer link and need to be routed. | 3.6.2-3.7.12 | |
| CM-15278 | During a link flap test, you might occasionally see a message similar to: warning: swp6: netlink: cannot set link swp6 down: <span class="error">[Errno 98]</span> Address already in use. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-15094 | Counter samples for an 80G bond (2 x 40G) exported from the switch show an interface speed (ifSpeed) of 14.464Gbps. | 3.2.0-3.7.12 | |
| CM-13316 | When you try to remove a VNI from a bridge using a regex match, the VNI is added back when you run the ifreload -a command. | 3.1.1-3.7.10 | 3.7.11-3.7.12 |
Fixed issues in 3.7.9
| Issue ID | Description | Affects |
|---|---|---|
| CM-27349 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 The latest upstream version 2.1+dfsg-12+deb8u12 fixes the following vulnerabilities listed in that announcement: CVE-2017-15038 Tuomas Tynkkynen discovered an information leak in 9pfs. CVE-2017-15119 Eric Blake discovered that the NBD server insufficiently restricts large option requests, resulting in denial of service. CVE-2017-15268 A memory leak in websockets support may result in denial of service. CVE-2017-15289 Guoxiang Niu discovered an OOB write in the emulated Cirrus graphics adaptor which could result in denial of service. CVE-2017-16845 Cyrille Chatras discovered an information leak in PS/2 mouse and keyboard emulation which could be exploited during instance migration. CVE-2017-17381 Dengzhan Heyuandong Bijunhua and Liweichao discovered that an implementation error in the virtio vring implementation could result in denial of service. CVE-2017-18043 Eric Blake discovered an integer overflow in an internally used macro which could result in denial of service. CVE-2018-5683 Jiang Xin and Lin ZheCheng discovered an OOB memory access in the emulated VGA adaptor which could result in denial of service. CVE-2018-7550 Cyrille Chatras discovered that an OOB memory write when using multiboot could result in the execution of arbitrary code. The following remains vulnerable in 2.1+dfsg-12+deb8u12: CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. Note: qemu is not installed by default, but is available in the repository for optional installation. | 3.0.0-3.7.8 |
| CM-26073 | {watchfrr calls sudo /usr/sbin/service frr restart bgpd but restarts all FRR daemons which can cause a large outage. This occurs because watchfrr uses an old style service command, which causes all daemons to restart when a daemon fails. | 3.7.7-3.7.8 |
| CM-26022 | When using the UFT lpm-equal profile, IPv6 routes are limited to 16K. | 3.7.8 |
| CM-25979 | Dynamic route-leaking works as expected until FRR is restarted or the switch is rebooted. After the restart or reboot, the import RT under the VRF where routes are being imported is incorrect. | 3.7.7-3.7.8 |
| CM-25956 | The following CVEs were announced in Debian Security Advisory DSA-4499-1 and affect the ghostscript package. ————————————————————————————— Debian Security Advisory DSA-4499-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso August 12, 2019 https://www.debian.org/security/faq ————————————————————————————— Package: ghostscript CVE ID: CVE-2019-10216 Debian Bug: 934638 Netanel reported that the .buildfont1 procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. For the oldstable distribution (stretch), this problem has been fixed in version 9.26a~dfsg-0+deb9u4. For the stable distribution (buster), this problem has been fixed in version 9.27~dfsg-2+deb10u1. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.0.0-3.7.8 |
| CM-25944 | The following CVEs were announced in Debian Security Advisory DSA-4495 and DSA 4497 and affect the linux kernel package. ——————————————————————————————— Debian Security Advisory DSA-4495-1 security@debian.org https://www.debian.org/security/ Ben Hutchings August 10, 2019 https://www.debian.org/security/faq ——————————————————————————————— Package: linux CVE ID: CVE-2018-20836 CVE-2019-1125 CVE-2019-1999 CVE-2019-10207 CVE-2019-10638 CVE-2019-12817 CVE-2019-12984 CVE-2019-13233 CVE-2019-13631 CVE-2019-13648 CVE-2019-14283 CVE-2019-14284 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2015-8553 Jan Beulich discovered that CVE-2015-2150 was not completely addressed. If a PCI physical function is passed through to a Xen guest, the guest is able to access its memory and I/O regions before enabling decoding of those regions. This could result in a denial-of-service (unexpected NMI) on the host. The fix for this is incompatible with qemu versions before 2.5. (CVE ID not yet assigned) Denis Andzakovic reported a missing type check in the IPv4 multicast routing implementation. A user with the CAP_NET_ADMIN capability (in any user namespace) could use this for denial-of-service (memory corruption or crash) or possibly for privilege escalation. CVE-2018-5995 ADLab of VenusTech discovered that the kernel logged the virtual addresses assigned to per-CPU data, which could make it easier to exploit other vulnerabilities. CVE-2018-20836 chenxiang reported a race condition in libsas, the kernel subsystem supporting Serial Attached SCSI (SAS) devices, which could lead to a use-after-free. It is not clear how this might be exploited. CVE-2019-1125 It was discovered that most x86 processors could speculatively skip a conditional SWAPGS instruction used when entering the kernel from user mode, and/or could speculatively execute it when it should be skipped. This is a subtype of Spectre variant 1, which could allow local users to obtain sensitive information from the kernel or other processes. It has been mitigated by using memory barriers to limit speculative execution. Systems using an i386 kernel are not affected as the kernel does not use SWAPGS. CVE-2019-1999 A race condition was discovered in the Android binder driver, which could lead to a use-after-free. If this driver is loaded, a local user might be able to use this for denial-of-service (memory corruption) or for privilege escalation. CVE-2019-1125 It was discovered that most x86 processors could speculatively skip a conditional SWAPGS instruction used when entering the kernel from user mode, and/or could speculatively execute it when it should be skipped. This is a subtype of Spectre variant 1, which could allow local users to obtain sensitive information from the kernel or other processes. It has been mitigated by using memory barriers to limit speculative execution. Systems using an i386 kernel are not affected as the kernel does not use SWAPGS. CVE-2019-3882 It was found that the vfio implementation did not limit the number of DMA mappings to device memory. A local user granted ownership of a vfio device could use this to cause a denial of service (out-of-memory condition). CVE-2019-3900 It was discovered that vhost drivers did not properly control the amount of work done to service requests from guest VMs. A malicious guest could use this to cause a denial-of-service (unbounded CPU usage) on the host. CVE-2019-10207 The syzkaller tool found a potential null dereference in various drivers for UART-attached Bluetooth adapters. A local user with access to a pty device or other suitable tty device could use this for denial-of-service (BU G/oops). CVE-2019-10638 Amit Klein and Benny Pinkas discovered that the generation of IP packet IDs used a weak hash function, “jhash”. This could enable tracking individual computers as they communicate with different remote servers and from different networks. The “siphash” function is now used instead. CVE-2019-10639 Amit Klein and Benny Pinkas discovered that the generation of IP packet IDs used a weak hash function that incorporated a kernel virtual address. This hash function is no longer used for IP IDs, although it is still used for other purposes in the network stack. CVE-2019-12817 It was discovered that on the PowerPC (ppc64el) architecture, the hash page table (HPT) code did not correctly handle fork() in a process with memory mapped at addresses above 512 TiB. This could lead to a use-after-free in the kernel, or unintended sharing of memory between user processes. A local user could use this for privilege escalation. Systems using the radix MMU, or a custom kernel with a 4 KiB page size, are not affected. CVE-2019-12984 It was discovered that the NFC protocol implementation did not properly validate a netlink control message, potentially leading to a null pointer dereference. A local user on a system with an NFC interface could use this for denial-of-service (BUG/oops). CVE-2019-13233 Jann Horn discovered a race condition on the x86 architecture, in use of the LDT. This could lead to a use-after-free. A local user could possibly use this for denial-of-service. CVE-2019-13631 It was discovered that the gtco driver for USB input tablets could overrun a stack buffer with constant data while parsing the device’s descriptor. A physically present user with a specially constructed USB device could use this to cause a denial-of-service (BUG/oops), or possibly for privilege escalation. CVE-2019-13648 Praveen Pandey reported that on PowerPC (ppc64el) systems without Transactional Memory (TM), the kernel would still attempt to restore TM state passed to the sigreturn() system call. A local user could use this for denial-of-service (oops). CVE-2019-14283 The syzkaller tool found a missing bounds check in the floppy disk driver. A local user with access to a floppy disk device, with a disk present, could use this to read kernel memory beyond the I/O buffer, possibly obtaining sensitive information. CVE-2019-14284 The syzkaller tool found a potential division-by-zero in the floppy disk driver. A local user with access to a floppy disk device could use this for denial-of-service (oops). (CVE ID not yet assigned) Denis Andzakovic reported a possible use-after-free in the TCP sockets implementation. A local user could use this for denial-of-service (memory corruption or crash) or possibly for privilege escalation. (CVE ID not yet assigned) The netfilter conntrack subsystem used kernel addresses as user-visible IDs, which could make it easier to exploit other security vulnerabilities. XSA-300 Julien Grall reported that Linux does not limit the amount of memory which a domain will attempt to baloon out, nor limits the amount of “foreign / grant map” memory which any individual guest can consume, leading to denial of service conditions (for host or guests). For the oldstable distribution (stretch), these problems have been fixed in version 4.9.168-1+deb9u5. For the stable distribution (buster), these problems have been fixed in version 4.19.37-5+deb10u2. For the oldstable distribution (stretch), these problems will be fixed soon. We recommend that you upgrade your linux packages. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.0.0-3.7.8 |
| CM-25784 | The following CVEs were announced in Debian Security Advisory DSA-4489-1. ————————————————————————————— Debian Security Advisory DSA-4489-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso July 27, 2019 https://www.debian.org/security/faq ————————————————————————————— Package: patch CVE ID: CVE-2019-13636 CVE-2019-13638 Debian Bug: 932401 933140 Imre Rad discovered several vulnerabilities in GNU patch, leading to shell command injection or escape from the working directory and access and overwrite files, if specially crafted patch files are processed. This update includes a bugfix for a regression introduced by the patch to address CVE-2018-1000156 when applying an ed-style patch (#933140). For the oldstable distribution (stretch), these problems have been fixed in version 2.7.5-1+deb9u2. For the stable distribution (buster), these problems have been fixed in version 2.7.6-3+deb10u1. We recommend that you upgrade your patch packages. For the detailed security status of patch please refer to its security tracker page at: https://security-tracker.debian.org/tracker/patch | 3.0.0-3.7.8 |
| CM-25783 | Cumulus Linux installer images have a shell script that validates checksum integrity. When you run onie-install, this check is run but the installer is still staged even if the checksum validation fails.To work around this issue, perform your own checksum validation before staging a new image with onie-install. | 3.7.7-3.7.8 |
| CM-25770 | On a Tomahawk switch, the 5m 40G DACs (40G CR4) do not come up when both sides have auto-negotiation enabled. | 3.7.7-3.7.8 |
| CM-25754 | A port that is used as both a double tag interface and a VXLAN access side interface does not forward correctly; VXLAN decapsulation is does not occur. However, do not configure double tagged interfaces on VXLAN uplink ports as this will cause VXLAN routing issues. | 3.6.2-3.7.8 |
| CM-25735 | When MLAG is re-establishing its peering after a member reboot, the VNIs on the peer briefly go into a protodown state. This can cause complete downtime to dually connected hosts as the member coming back up is still in initDelay. This issue does resolve itself as the VNIs do come back up within ten seconds. | 3.7.8 |
| CM-25684 | For interfaces configured with RS FEC, when switchd is restarted, the link goes down but does not automatically come back up. This occurs because the FEC status is not replayed correctly into the kernel.To work around this issue, run the ifreload -a command to bring up the interface after switchd is restarted. | 3.7.6-3.7.8 |
| CM-25674 | On Mellanox switches, policer iptables are not working as expected. For example, when using a policer with mode KB/MB/GB to rate-limit interfaces, the syntax is accepted but the data plane transfer speed is not affected by the rule. | 3.7.6-3.7.8 |
| CM-25664 | On the Trident3 platform, you can only add 50 percent of the total ECMP next hops. A log message indicates that the table is full. | 3.7.7-3.7.8 |
| CM-25646 | When moving an IP address from the address line to inet dhcp, then issuing the ifreload -a command, the old address is not removed from the interface. NCLU still reports the old address only and reports it as a DHCP address. | 3.7.6-3.7.8 |
| CM-25619 | After configuring switchd hal.bcm.per_vlan_router_mac_lookup to TRUE on a Broadcom switch, layer 2 traffic works over VXLAN but the host is not able to ping the locally connected gateway and loses routing ability to other IPs and subnets. | 3.6.0-3.7.8 |
| CM-25610 | BGP update packets are sometimes missing the mandatory nexthop attribute, which causes connections to reset. For example, this issue is seen when using VRF route leaking with a mix of BGP unnumbered and BGP numbered peers. | 3.7.6-3.7.8 |
| CM-25489 | When BGP remove-private-AS replace-AS is configured under the BGP IPv4 or IPv6 address family between a pair of switches configured as BGP peers, a BGP route update might cause the BGP session to flap.To work around this issue, do not configure remove-private-AS replace-AS in the BGP IPv4 or IPv6 address family. | 3.7.6-3.7.8 |
| CM-25488 | On Broadcom-based VXLAN routing capable platforms, VXLAN traffic received at the egress VTEP might drop because the hardware is mis-programming. This issue is related to timing and is not easily reproduced. This issue might occur after a VXLAN interface (VNI) state transition (the peerlink goes down and puts VNI into a protodown state, then the peerlink comes back and the VNI returns to UP) and is related to how the next-hop information is programmed in hardware. Sometimes the host routes corresponding to this VXLAN segment are mis-programmed with the wrong next hop information. To work around this issue, restart the switchd service with the sudo systemctl restart switchd.service command. | |
| CM-25467 | The following CVEs were announced in Debian Security Advisory DSA-4472-1 and affect the expat (libexpat1) package. ————————————————————————————- Debian Security Advisory DSA-4472-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso June 28, 2019 https://www.debian.org/security/faq ————————————————————————————- Package: expat CVE ID: CVE-2018-20843 Debian Bug: 931031 It was discovered that Expat, an XML parsing C library, did not properly handled XML input including XML names that contain a large number of colons, potentially resulting in denial of service. For the stable distribution (stretch), this problem has been fixed in version 2.2.0-2+deb9u2. We recommend that you upgrade your expat packages. For the detailed security status of expat, refer to its security tracker page at: https://security-tracker.debian.org/tracker/expat | 3.0.0-3.7.8 |
| CM-25432 | The snmpd service frequently crashes due to double free or corruption. | 3.7.6-3.7.8 |
| CM-25417 | The IP neighbor entry for a link-local next hop (169.254.x.x) is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which can be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. | 3.7.7-3.7.8 |
| CM-25414 | On the Mellanox SN2410 switch, switchd does not start. | 3.7.2-3.7.8 |
| CM-25395 | When you run the NCLU net del all command, the exec-timeout setting changes in the /etc/frr.frr.conf file. | 3.7.6-3.7.8 |
| CM-25358 | When you configure the link-down yes attribute to a physical SVI, the VRR (-v0) interface is not brought down, and the locally-connected subnet can still be redistributed into routing protocols and advertised to neighbors despite the physical SVI being administratively down.To work around this issue, manually bring down the VRR (-v0) interface with the ip link set dev command. For example:cumulus@switch:~$ sudo ip link set dev vlan1755-v0 down | 3.6.1-3.7.8 |
| CM-25343 | The following CVEs were announced in Debian Security Advisory DSA-4465-1 and affect the linux kernel. ——————————————————————————————- Debian Security Advisory DSA-4465-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso June 17, 2019 https://www.debian.org/security/faq ——————————————————————————————- Package: linux CVE ID: CVE-2019-3846 CVE-2019-5489 CVE-2019-9500 CVE-2019-9503 CVE-2019-10126 CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 CVE-2019-11486 CVE-2019-11599 CVE-2019-11815 CVE-2019-11833 CVE-2019-11884 Debian Bug: 928989 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2019-3846, CVE-2019-10126 huangwen reported multiple buffer overflows in the Marvell wifi (mwifiex) driver, which a local user could use to cause denial of service or the execution of arbitrary code. CVE-2019-5489 Daniel Gruss, Erik Kraft, Trishita Tiwari, Michael Schwarz, Ari Trachtenberg, Jason Hennessey, Alex Ionescu, and Anders Fogh discovered that local users could use the mincore() system call to obtain sensitive information from other processes that access the same memory-mapped file. CVE-2019-9500, CVE-2019-9503 Hugues Anguelkov discovered a buffer overflow and missing access validation in the Broadcom FullMAC wifi driver (brcmfmac), which a attacker on the same wifi network could use to cause denial of service or the execution of arbitrary code. CVE-2019-11477 Jonathan Looney reported that a specially crafted sequence of TCP selective acknowledgements (SACKs) allows a remotely triggerable kernel panic. CVE-2019-11478 Jonathan Looney reported that a specially crafted sequence of TCP selective acknowledgements (SACKs) will fragment the TCP retransmission queue, allowing an attacker to cause excessive resource usage. CVE-2019-11479 Jonathan Looney reported that an attacker could force the Linux kernel to segment its responses into multiple TCP segments, each of which contains only 8 bytes of data, drastically increasing the bandwidth required to deliver the same amount of data. This update introduces a new sysctl value to control the minimal MSS (net.ipv4.tcp_min_snd_mss), which by default uses the formerly hard-coded value of 48. We recommend raising this to 536 unless you know that your network requires a lower value. CVE-2019-11486 Jann Horn of Google reported numerous race conditions in the Siemens R3964 line discipline. A local user could use these to cause unspecified security impact. This module has therefore been disabled. CVE-2019-11599 Jann Horn of Google reported a race condition in the core dump implementation which could lead to a use-after-free. A local user could use this to read sensitive information, to cause a denial of service (memory corruption), or for privilege escalation. CVE-2019-11815 It was discovered that a use-after-free in the Reliable Datagram Sockets protocol could result in denial of service and potentially privilege escalation. This protocol module (rds) is not auto-loaded on Debian systems, so this issue only affects systems where it is explicitly loaded. CVE-2019-11833 It was discovered that the ext4 filesystem implementation writes uninitialised data from kernel memory to new extent blocks. A local user able to write to an ext4 filesystem and then read the filesystem image, for example using a removable drive, might be able to use this to obtain sensitive information. CVE-2019-11884 It was discovered that the Bluetooth HIDP implementation did not ensure that new connection names were null-terminated. A local user with CAP_NET_ADMIN capability might be able to use this to obtain sensitive information from the kernel stack. For the stable distribution (stretch), these problems have been fixed in version 4.9.168-1+deb9u3. We recommend that you upgrade your linux packages. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.7.6-3.7.8 |
| CM-25295 | The ifquery command should return a non-zero value if there is a syntax error. However, it currently returns zero. This issue affects automation scripts that validate a file before copying it into place. | 3.7.6-3.7.8 |
| CM-25284 | If you configure a sys-mac with a single digit, ifreload -a does not indicate that the MAC address is invalid for the MLAG sys-mac and the clagd process fails silently. | 3.7.6-3.7.8 |
| CM-25240 | If the address-virtual MAC address is missing a leading zero in the last octet, the interface bounces. | 3.7.6-3.7.8 |
| CM-25079 | The snmpd service exits with a message similar to the following:Error in ‘/usr/sbin/snmpd’: double free or corruption (fasttop): 0x00000000018a4e50 *** This problem might occur during or after network convergence events. For example, when bgpd needs to process a high number of updates and the CPU cannot keep up, bgpd is disconnected and agentx generates a core dump in snmpd due to a memory allocation problem.To work around this issue, disable agentx by commenting out the following lines in the /etc/snmp/snmpd.conf file. Then, restart the snmpd service with the systemctl restart snmpd command.agentxperms 777 777 snmp snmp agentxsocket /var/agentx/master If you still want to poll the BGP4-MIB information, re-enable the bgp pass persist script by adding the following line in the /etc/snmp/snmpd.conf file:pass_persist 1.3.6.1.2.1.15 /usr/share/snmp/bgp4_pp.py | 3.7.2-3.7.8 |
| CM-24963 | The following CVEs were announced in Debian Security Advisory DSA-4440-1. ————————————————————————————— Debian Security Advisory DSA-4440-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff May 09, 2019 https://www.debian.org/security/faq ————————————————————————————— Package: bind9 CVE ID: CVE-2018-5743 CVE-2018-5745 CVE-2019-6465 Multiple vulnerabilities were found in the BIND DNS server: CVE-2018-5743 Connection limits were incorrectly enforced. CVE-2018-5745 The “managed-keys” feature was susceptible to denial of service by triggering an assert. CVE-2019-6465 ACLs for zone transfers were incorrectly enforced for dynamically loadable zones (DLZs). For the stable distribution (stretch), these problems have been fixed in version 1:9.10.3.dfsg.P4-12.3+deb9u5. We recommend that you upgrade your bind9 packages. For the detailed security status of bind9 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/bind9 | 3.0.0-3.7.8 |
| CM-24784 | NCLU is unable to delete a BGP neighbor configuration if there is a VRF VNI mapping in the /etc/frr/frr.conf file. For example, the following NCLU command produces an error:cumulus@leaf01$ net del bgp neighbor swp5 interface peer-group spine ‘router bgp 65001’ configuration does not have ‘neighbor swp5 interface peer-group spine’ | 3.7.7-3.7.8 |
| CM-24593 | On a Dell S5248F (Trident3) switch, packets from switch ports are forwarded to the CPU and are sometimes corrupted. The corruption might result in BGP peerings being down, which can lead to all VXLAN traffic to and from a node to be lost, causing an outage to dually connected hosts in a rack. To work around this issue, restart switchd. | 3.7.3-3.7.8 |
| CM-24544 | If the clagd-vxlan-anycast-ip is removed from the /etc/network/interfaces file (either with the NCLU command or by editing the file manually), MLAG still believes it is present until clagd restarts. | 3.7.3-3.7.8 |
| CM-24440 | bgpd creates a core dump at zclient_send_interface_radv_req. This is an issue with how FRRouting checks next hops and has been pushed upstream to FRRouting. | 3.7.6-3.7.8 |
| CM-23652 | The NCLU command net show bridge spanning-tree does not show the MLAG peer link as part of the STP forwarding instance.To work around this issue, use the mstpctl command to confirm the STP status of the port. | 3.7.2-3.7.8 |
| CM-23636 | The following CVEs were announced in Debian Security Advisory DSA-4436-1 and affect the imagemagick packages. ——————————————————————————————- Debian Security Advisory DSA-4371-1 security@debian.org https://www.debian.org/security/ Yves-Alexis Perez January 22, 2019 https://www.debian.org/security/faq ——————————————————————————————- Max Justicz discovered a vulnerability in APT, the high level package manager. The code handling HTTP redirects in the HTTP transport method doesn’t properly sanitize fields transmitted over the wire. This vulnerability could be used by an attacker located as a man-in-the-middle between APT and a mirror to inject malicous content in the HTTP connection. This content could then be recognized as a valid package by APT and used later for code execution with root privileges on the target machine. Since the vulnerability is present in the package manager itself, it is recommended to disable redirects in order to prevent exploitation during this upgrade only, using: apt -o Acquire::http::AllowRedirect=false update apt -o Acquire::http::AllowRedirect=false upgrade The code handling HTTP redirects in the HTTP transport method doesn’t properly sanitize fields transmitted over the wire. This vulnerability could be used by an attacker located as a man-in-the-middle between APT and a mirror to inject malicous content in the HTTP connection. This content could then be recognized as a valid package by APT and used later for code execution with root privileges on the target machine. Since the vulnerability is present in the package manager itself, it is recommended to disable redirects in order to prevent exploitation during this upgrade only, using: apt -o Acquire::http::AllowRedirect=false update apt -o Acquire::http::AllowRedirect=false upgrade This is known to break some proxies when used against security.debian.org. If that happens, people can switch their security APT source to use deb http://cdn-fastly.deb.debian.org/debian-security stable/updates main For the stable distribution (stretch), this problem has been fixed in version 1.4.9. | 3.0.0-3.7.8 |
| CM-23523 | Modifying the /etc/netd.conf file to set show_linux_command = True does not take effect. | 3.7.2-3.7.8 |
| CM-23431 | On the Trident3 switch, the input chain ACLs drop action forwards packets if the traffic is destined to the CPU on an SVI. | 3.6.2-3.7.8 |
| CM-23398 | The following CVEs were announced in Debian Security Advisory DSA-4359-1 and affect the wireshark packages, some of which are available for optional installation on Cumulus Linux: CVE ID: CVE-2018-12086 CVE-2018-18225 CVE-2018-18226 CVE-2018-18227 CVE-2018-19622 CVE-2018-19623 CVE-2018-19624 CVE-2018-19625 CVE-2018-19626 CVE-2018-19627 CVE-2018-19628 All CVEs except for CVE-2018-12086 are fixed in Cumulus Linux 3.7.9. Packages: libwireshark5, libwireshark-data, libwiretap8, libwscodecs2, libwsutil9, tshark, wireshark, wireshark-common, wireshark-doc These problems have been fixed in version 1.12.1+g01b65bf-4+deb8u19 We recommend that you upgrade your wireshark packages. For the detailed security status of wireshark, refer to its security tracker page at: https://security-tracker.debian.org/tracker/wireshark | 3.0.0-3.7.8 |
| CM-23285 | When you remove an interface from a bridge and add it to a VRF in the same commit/ifreload, the IPv6 link-local address is not created automatically. To work around this issue, do the change in two separate commits. First, remove the interface from the bridge, which causes it to be a layer 2 interface. Then, enslave the interface to the VRF. | 3.7.2-3.7.8 |
| CM-23114 | The following CVEs were announced in Debian Security Advisory DSA-4347-1. ————————————————————————————————– Debian Security Advisory DSA-4347-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso November 29, 2018 https://www.debian.org/security/faq ————————————————————————————————– Package: perl CVE ID: CVE-2018-18311 CVE-2018-18312 CVE-2018-18313 CVE-2018-18314 Multiple vulnerabilities were discovered in the implementation of the Perl programming language. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2018-18311 Jayakrishna Menon and Christophe Hauser discovered an integer overflow vulnerability in Perl_my_setenv leading to a heap-basedbuffer overflow with attacker-controlled input. CVE-2018-18312 Eiichi Tsukata discovered that a crafted regular expression could cause a heap-based buffer overflow write during compilation, potentially allowing arbitrary code execution. CVE-2018-18313 Eiichi Tsukata discovered that a crafted regular expression could cause a heap-based buffer overflow read during compilation which leads to information leak. CVE-2018-18314 Jakub Wilk discovered that a specially crafted regular expression could lead to a heap-based buffer overflow. For the stable distribution (stretch), these problems have been fixed in version 5.24.1-3+deb9u5. We recommend that you upgrade your perl packages. For the detailed security status of perl please refer to its security tracker page at: https://security-tracker.debian.org/tracker/perl | 3.0.0-3.7.8 |
| CM-23096 | The following CVEs were announced in Debian Security Advisory DSA-4372-1. ————————————————————————————————– Debian Security Advisory DSA-4346-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso November 27, 2018 https://www.debian.org/security/faq ————————————————————————————————– Package: ghostscript CVE ID: CVE-2018-19409 CVE-2018-19475 CVE-2018-19476 CVE-2018-19477 Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service or the execution of arbitrary code if a malformed Postscript file is processed (despite the -dSAFER sandbox being enabled). This update rebases ghostscript for stretch to the upstream version 9.26 which includes additional changes. For the stable distribution (stretch), these problems have been fixed in version 9.26~dfsg-0+deb9u1. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript please refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.0.0-3.7.8 |
| CM-22834 | In rare cases, certain IPv6 BGP peers fail to reestablish after switchd restarts. | 3.7.2-3.7.8 |
| CM-22608 | Mellanox Spectrum and Helix4 switches occasionally send malformed packets and do not send any flow samples (only counters). While this issue is fixed for switches with the Spectrum ASIC, this is a known limitation on this Helix4 platform. | 3.6.2-3.7.8 |
| CM-22203 | By default, the nginx server used for the HTTP API on port 8080 is enabled, but does not listen to external requests. However, it appears to be listening and answering external requests. | 3.6.1-3.7.8 |
| CM-21511 | If a VNI is configured before the bridge in /etc/network/interfaces, the switch does not send IGMP queries.To work around this issue, edit the /etc/network/interfaces file to define the bridge before the VNI. For example:# The primary network interface auto eth0 iface eth0 inet dhcp auto lo iface lo inet loopback address 10.26.10.11/32 auto swp9 iface swp9 bridge-access 100 auto swp10 iface swp10 bridge-access 100 auto bridge iface bridge bridge-ports swp9 swp10 vni-10 bridge-vids 100 bridge-vlan-aware yes bridge-mcquerier 1 auto vni-10 iface vni-10 vxlan-id 10 vxlan-local-tunnelip 10.0.0.11 bridge-access 100 auto bridge.100 vlan bridge.100 bridge-igmp-querier-src 123.1.1.1 auto vlan100 iface vlan100 address 10.26.100.2/24 vlan-id 100 vlan-raw-device bridge . | 3.6.1-3.7.8 |
| CM-20966 | The NCLU net show lldp and net show interface commands do not show LLDP information for swp* (eth is unaffected). | 3.6.0-3.7.8 |
| CM-20809 | The following CVEs were announced in a Debian Security Advisory. ————————————————————————————————– It was discovered that Ghostscript incorrectly handled certain PostScript files. An attacker could possibly use this to cause a denial of server. (CVE-2016-10317) It was discovered that Ghostscript incorrectly handled certain PDF files. An attacker could possibly use this to cause a denial of service. (CVE-2018-10194) Debian CVE links: https://security-tracker.debian.org/tracker/CVE-2016-10317 and https://security-tracker.debian.org/tracker/CVE-2018-10194 | 3.0.0-3.7.8 |
| CM-19960 | The following CVEs were announced in Debian Security Advisory DSA-4131. ——————————————————————————————- Debian Security Advisory DSA-4131-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff March 04, 2018 https://www.debian.org/security/faq —————————————————————————————— Package: xen CVE ID: CVE-2018-7540 CVE-2018-7541 CVE-2018-7542 Multiple vulnerabilities have been discovered in the Xen hypervisor: CVE-2018-7540 Jann Horn discovered that missing checks in page table freeing may result in denial of service. CVE-2018-7541 Jan Beulich discovered that incorrect error handling in grant table checks may result in guest-to-host denial of service and potentially privilege escalation. CVE-2018-7542 Ian Jackson discovered that insufficient handling of x86 PVH guests without local APICs may result in guest-to-host denial of service. For the stable distribution (stretch), these problems have been fixed in version 4.8.3+comet2+shim4.10.0+comet3-1+deb9u5. We recommend that you upgrade your xen packages. For the detailed security status of xen please refer to its security tracker page at: https://security-tracker.debian.org/tracker/xen | 3.0.0-3.7.8 |
| CM-18537 | Drops due to congestion do not appear to be counted on a Mellanox switch. To work around this issue, run the sudo ethtool -S swp1 command to collect interface traffic statistics. | 3.4.2-3.7.8 |
3.7.8 Release Notes
Open issues in 3.7.8
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-29740 | The exim4 package available for optional installation on Cumulus Linux 3.x has the following vulnerability:DLA-2213-1 / CVE-2020-12783: Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. The spa authentication driver is not enabled by default. Vulnerable: <= 4.84.2-2+deb8u6 Fixed: 4.84.2-2+deb8u7 | 3.0.0-3.7.12 | |
| CM-29556 | CVE-2020-11868: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp. This affects: ntp-4.2.8p12 (possibly earlier) and ntp-4.2.8p13 The fix for https://bugs.ntp.org/3445 introduced a bug whereby a system that is running ntp-4.2.8p12 or p13 that only has one unauthenticated time source can be attacked in a way that causes the victim’s next poll to its source to be delayed, for as long as the attack is maintained. http://support.ntp.org/bin/view/Main/NtpBug3592 gives the following mitigations if it is not possible to upgrade to a version with the fix:
| 3.0.0-3.7.12 | |
| CM-29518 | The following vulnerability affects the ruby2.1 package, which is installed by default: CVE-2020-10663: The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.1 has an unsafe object creation vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. Vulnerable: 2.1.5-2+deb8u9 Fixed: 2.1.5-2+deb8u10 | 3.0.0-3.7.12 | |
| CM-29484 | The following vulnerability affects libgd2/libgd3: CVE-2018-14553: gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled). Vulnerable: <= 2.1.0-5+deb8u13 Fixed: 2.1.0-5+deb8u14 | 3.0.0-3.7.12 | |
| CM-29483 | The following vulnerability affects imptool: CVE-2020-5208: It’s been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. Vulnerable: <= 1.8.14-4 Fixed: 1.8.14-4+deb8u1 | 3.0.0-3.7.12 | |
| CM-29284 | The following vulnerabilities affect git, which is available in the repository for optional installation: CVE-2020-5260: Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. CVE-2020-11008: Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. | 3.0.0-3.7.12 | |
| CM-29208 | The following vulnerability has been announced in ceph; the associated libraries librados2 and librbd1 are available in the Cumulus Linux 3 repository for optional installation. CVE-2020-1760: It was discovered that there was a header-splitting vulnerability in ceph, a distributed storage and file system. Vulnerable: <= 0.80.7-2+deb8u2 Fixed: 0.80.7-2+deb8u4 | 3.0.0-3.7.12 | |
| CM-29048 | The following vulnerability exists in the ruby2.1 package: CVE-2016-2338: An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer “head” allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow Vulnerable: <= 2.1.5-2+deb8u8 Fixed: 2.1.5-2+deb8u9 | 3.0.0-3.7.12 | |
| CM-29040 | The following issue has been found in e2fsprogs, a package that contains ext2/ext3/ext4 file system utilities:CVE-2019-5188: A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. | 3.0.0-3.7.12 | |
| CM-28993 | The following security vulnerability has been announced that affects the libicu52 package: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. Vulnerable: <= 52.1-8+deb8u7 Fixed: 52.1-8+deb8u8 | 3.0.0-3.7.12 | |
| CM-28992 | The following security vulnerability has been announced: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. | 3.0.0-3.7.12 | |
| CM-28954 | The python-twisted-* packages, which are available for optional installation in Cumulus Linux but are not installed by default, were found to have the following security vulnerabilities: CVE-2020-10808: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request. CVE-2020-10809: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request. | 3.0.0-3.7.12 | |
| CM-28944 | A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted. To work around this issue, reenter the redistribute <connected\|static> route-map <route-map-name> statement in the configuration. | 3.6.2-3.7.12 | |
| CM-28938 | When you install an ACL LOG/DROP rule on a layer 3 ingress interface that is a member of a VRF, traffic that matches this rule is not logged and is still forwarded. To work around this issue, apply the ACL LOG/DROP rule to the VRF device itself or to the layer 2 VNI. | 3.7.6-3.7.12 | |
| CM-28867 | The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12 | |
| CM-28816 | The following security advisory has been announced for bash: CVE-2019-18276 Qualys scan QID 372268 setuid vulnerability When bash or bash scripts are run setuid, bash is supposed to drop privileges, but does so incorrectly, so that an attacker with command access to the shell can use enable -f for runtime loading of a new builtin that calls setuid() to regain dropped privileges.To work around this issue, do not make bash or bash scripts setuid. | 3.0.0-3.7.12 | |
| CM-28811 | The following security vulnerability affects the libvpx1 library:CVE-2020-0034: It was discovered that there was an out-of-bounds buffer read vulnerability in libvpx, a library implementing the VP8 & VP9 videocodecs. | 3.0.0-3.7.12 | |
| CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.12 | |
| CM-28655 | When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.6.1-3.7.12 | |
| CM-28488 | The following CVEs were announced that affect the cron package. All of these require untrusted local user access.CVE-2017-9525 is a local user privilege escalation attack: In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs. CVE-2019-9704, CVE-2019-9705, CVE-2019-9706 are local user denial of service attacks. Note: the fix for CVE-2019-9705 imposes a limitation on the length of a crontab file (the vulnerability was that an unlimited size crontab file could cause excessive memory consumption). https://security-tracker.debian.org/tracker/DLA-1723-1 | 3.0.0-3.7.12 | |
| CM-28487 | The following CVE was announced for rsyslog: CVE-2019-17041 CVE-2019-17042 rsyslogd, when receiving remote log messages and using optional pmaixforwardedfrom or pmcisconames parser modules (not enabled by default on Cumulus Linux), is vulnerable to CVE-2019-17041 and CVE-2019-17042 where malicious messages that appear to be from AIX or Cisco respectively may be caused to skip sanity checks, resulting in incorrect negative lengths causing heap overflows.Do not enable (with $UDPServerRun or $InputTCPServerRun) receiving syslog messages from other hosts by the network. Also, do not enable (with $ModLoad) the vulnerable parsers pmaixforwardedfrom or pmcisconames.<br/>The default /etc/rsyslog.conf file on Cumulus Linux does NOT enable $UDPServerRun or $InputTCPServerRun, so the vulnerability is not network exploitable in the default configuration. In addition, the vulnerable parsers are not enabled in the default configuration. | 3.0.0-3.7.12 | |
| CM-28486 | The following vulnerability has been found in the libgcrypt20 cryptographic library. CVE-2019-13627: there was a ECDSA timing attack. For more information, see https://www.debian.org/lts/security/2020/dla-1931-2.en.html Vulnerable: 1.6.3-2+deb8u7 Fixed: 1.6.3-2+deb8u8 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28485 | The following vulnerability affects libxml2: CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c has a memory leak related to newDoc->oldNs. This can lead to a denial of service. For more information, see https://www.debian.org/lts/security/2019/dla-2048.en.html . Vulnerable: 2.9.1+dfsg1-5+deb8u7 Fixed: 2.9.1+dfsg1-5+deb8u8 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28484 | The following vulnerability affects libbsd, a package containing utility functions from BSD systems. CVE-2016-2090: In function fgetwln() an off-by-one error could triggers a heap buffer overflow. For more information, see https://www.debian.org/lts/security/2019/dla-2052.en.html . Vulnerable: 0.7.0-2 Fixed: 0.7.0-2+deb8u1 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28374 | When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-3.7.12 | |
| CM-28224 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2019-15890: libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. Vulnerable: <= 2.1+dfsg-12+deb8u11 Fixed: 2.1+dfsg-12+deb8u12 | 3.0.0-3.7.10 | 3.7.11-3.7.12 |
| CM-28223 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-1711: block: iscsi: OOB heap access via an unexpected response of iSCSI Server | 3.0.0-3.7.12 | |
| CM-28222 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-7039: tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code. Vulnerable: <= 2.1+dfsg-12+deb8u12 Fixed: 2.1+dfsg-12+deb8u13 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28219 | The following vulnerability affects sudo, which is installed by default on Cumulus Linux. It is potentially exploitable on Cumulus Linux if pwfeedback (which is NOT enabled by default) is enabled in the /etc/sudoers file. CVE-2019-18634: In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c. For more information, refer to: https://security-tracker.debian.org/tracker/source-package/sudo https://security-tracker.debian.org/tracker/CVE-2019-18634 https://www.sudo.ws/alerts/pwfeedback.html Vulnerable: <= 1.8.10p3-1+deb8u6 Fixed: 1.8.10p3-1+deb8u7 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28091 | Two security issues were found in the Python interface to the apt package manager, which is installed by default on Cumulus Linux; package downloads from unsigned repositories were incorrectly rejected (CVE-2019-15796) and the hash validation relied on MD5 (CVE-2019-15795). For more information, refer to https://security-tracker.debian.org/tracker/source-package/python-apt Vulnerable: 0.9.3.12 Fixed: 0.9.3.13 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28076 | After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom --init command. | 3.6.0-3.7.12 | |
| CM-28016 | On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. | 3.7.7-3.7.11 | 3.7.12 |
| CM-28007 | When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 | 3.7.12 |
| CM-27947 | Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. | 3.7.0-3.7.11 | 3.7.12 |
| CM-27937 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 One of the listed vulnerabilities is still present in the latest upstream version 2.1+dfsg-12+deb8u12 (the others have been fixed): CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. https://security-tracker.debian.org/tracker/CVE-2017-15124 | 3.0.0-3.7.12 | |
| CM-27924 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.26.dfsg1-13+deb8u1 Fixed: 2.1.26.dfsg1-13+deb8u2 | 3.0.0-3.7.11 | 3.7.12 |
| CM-27855 | The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. | 3.7.0-3.7.11 | 3.7.12 |
| CM-27793 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.27+dfsg-1 Fixed: 2.1.27+dfsg-1+deb10u1 | 3.0.0-3.7.12 | |
| CM-27698 | SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.12 | |
| CM-27683 | The following CVEs were announced that affect the Linux kernel: CVE-2019-12378: An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-12381: An issue was discovered in ip_ra_control in net/ipv4/ip_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-15239: In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation. CVE-2019-19062: A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042. CVE-2019-19537: In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID-303911cfc5b9. This affects drivers/usb/core/file.c. CVE-2019-20054: In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e. | 3.0.0-3.7.11 | 3.7.12 |
| CM-27646 | Several vulnerabilities have been discovered in Git, a fast, scalable, distributed revision control system, which is available in the Cumulus Linux 3.x repositories for optional installation. CVE-2019-1348: export-marks is insecure, fix is to disable by default. CVE-2019-1349: .git / git~1 filename vulnerability on NTFS CVE-2019-1352: .git vulnerability with NTFS Alternate Streams Accesses CVE-2019-1353: NTFS filesystem protection should be on by default CVE-2019-1387: dubiously-nested submodule git directories should be disallowed CVE-2019-19604: submodule update repository code execution vulnerability Vulnerable: <= 2.1.4-2.1+deb8u7 Fixed: 2.1.4-2.1+deb8u8 | 3.0.0-3.7.12 | |
| CM-27628 | The following security vulnerabilities have been announced in the nss/libnss3 library, which is not installed by default but is available in the repository: CVE-2019-11745: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate CVE-2019-17007: nss: Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may crash with a NULL deref leading to DoS See https://security-tracker.debian.org/tracker/source-package/nss for more information. Vulnerable: <= 3.26-1+debu8u7 Fixed: 3.26-1+debu8u9 | 3.0.0-3.7.10 | 3.7.11-3.7.12 |
| CM-27351 | On rare occasions, after rebooting the MLAG secondary switch, one MLAG device might see the peer as down, which can cause traffic disruption to connected hosts. | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-27349 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 The latest upstream version 2.1+dfsg-12+deb8u12 fixes the following vulnerabilities listed in that announcement: CVE-2017-15038 Tuomas Tynkkynen discovered an information leak in 9pfs. CVE-2017-15119 Eric Blake discovered that the NBD server insufficiently restricts large option requests, resulting in denial of service. CVE-2017-15268 A memory leak in websockets support may result in denial of service. CVE-2017-15289 Guoxiang Niu discovered an OOB write in the emulated Cirrus graphics adaptor which could result in denial of service. CVE-2017-16845 Cyrille Chatras discovered an information leak in PS/2 mouse and keyboard emulation which could be exploited during instance migration. CVE-2017-17381 Dengzhan Heyuandong Bijunhua and Liweichao discovered that an implementation error in the virtio vring implementation could result in denial of service. CVE-2017-18043 Eric Blake discovered an integer overflow in an internally used macro which could result in denial of service. CVE-2018-5683 Jiang Xin and Lin ZheCheng discovered an OOB memory access in the emulated VGA adaptor which could result in denial of service. CVE-2018-7550 Cyrille Chatras discovered that an OOB memory write when using multiboot could result in the execution of arbitrary code. The following remains vulnerable in 2.1+dfsg-12+deb8u12: CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. Note: qemu is not installed by default, but is available in the repository for optional installation. | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-27295 | IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.[ip6tables] | 3.7.2-3.7.11 | 3.7.12 |
| CM-27279 | When ECMP routes have both VXLAN (symmetric routing) and non-VXLAN paths, the non-VXLAN path is incorrectly installed in the RIB and FIB to point across VXLAN. The non-VXLAN next-hop will be installed as an offload entry in the neighbor table (ip neigh show) with a mac address of 00:00:00:00:00:00. | 3.7.3-3.7.12 | |
| CM-27174 | The ospfd daemon might crash with the following kernel trace:2019-11-06T23:00:08.261749+09:00 cumulus ospfd[5339]: Assertion ‘node’ failed in file ospfd/ospf_packet.c, line 671, function ospf_write | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-27096 | On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10 | 3.7.11-3.7.12 |
| CM-27094 | On the Delta AG9032v1 switch, smonctl and sensors report inaccurate PSU current and power. | 3.5.0-3.7.12 | |
| CM-27025 | On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. | 3.7.2-3.7.10 | 3.7.11-3.7.12 |
| CM-26954 | In the default VRF, VRRP might crash and stay in an initialize state. As a result, VRRP multicast traffic is not generated. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26894 | The neighmgrd service does not ignore neighbors on reserved devices (lo and management devices). This issue is not seen when management VRF is enabled. | 3.7.8-3.7.11 | 3.7.12 |
| CM-26838 | You might experience a bgpd memory usage increase and significant update exchanges due to host moves between VTEPs. | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-26829 | Frames received with a VLAN tag of 0 on an interface configured as a bridge port and forwarded to the CPU for processing might appear tagged with the native VLAN when viewed with tcpdump. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26769 | Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26691 | BGP is configured with soft reconfiguration-in for its peers, which is not working correctly and causes routes to have an unexpected label. As a result, transit traffic is not forwarded by the switch. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26657 | When you install a large number of new rules with nonatomic mode enabled, there is a chance that you install more rules than the number of available slots in the slice, which results in the slice being completely wiped and reinstalled. This causes a large drop increase, including to cpu0, and might cause a major outage by dropping all BGP sessions. | 3.6.1-3.7.10 | 3.7.11-3.7.12 |
| CM-26525 | When an MLAG peerlink frequently alternates states between learning and blocking, an excessive number of TCP sessions might be created, which results in the following error display:OSError: [Errno 24] Too many open files | 3.6.2-3.7.10 | 3.7.11-3.7.12 |
| CM-26523 | Package: hostapd CVE ID: CVE-2019-13377 CVE-2019-16275 Two vulnerabilities were found in the WPA protocol implementation found in wpa_supplication (station) and hostapd (access point). CVE-2019-13377 A timing-based side-channel attack against WPA3’s Dragonfly handshake when using Brainpool curves could be used by an attacker to retrieve the password. CVE-2019-16275 Insufficient source address validation for some received Management frames in hostapd could lead to a denial of service for stations associated to an access point. An attacker in radio range of the access point could inject a specially constructed unauthenticated IEEE 802.11 frame to the access point to cause associated stations to be disconnected and require a reconnection to the network. Fixed version: 1:2.8.0-cl4u3 | 3.7.0-3.7.10 | 3.7.11-3.7.12 |
| CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.12 | |
| CM-26450 | Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.12 | |
| CM-26351 | After you remove a subinterface, the BGP session stays in a Connect state. | 3.7.8-3.7.11 | 3.7.12 |
| CM-26308 | An interface alias configured outside FRR using iproute2 is imported into the FRR running configuration and overrides the internal description. After an FRR reload, this causes FRR to delete the interface alias in an inefficient way. Depending on how many interfaces with aliases you have configured, this can cause a FRR reload to time out.To work around this issue, remove the interface alias description from iproute2. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26288 | On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.12 | |
| CM-26272 | On the Mellanox Spectrum switch, a route withdrawal might cause the associated next hop neighbor entry to be deleted in hardware but remain in the kernel. This can cause traffic going through the directly connected route to the removed neighbor entry to be forwarded to the CPU. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26256 | The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. | 3.7.8-3.7.12 | |
| CM-26255 | On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26252 | The following CVEs were announced that affect the ghostscript package: CVE ID : CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817 It was discovered that various procedures in Ghostscript, the GPL PostScript/PDF interpreter, do not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.7.0-3.7.10 | 3.7.11-3.7.12 |
| CM-26241 | On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. | 3.7.6-3.7.11 | 3.7.12 |
| CM-26230 | When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. | 3.7.8-3.7.12 | |
| CM-26217 | NCLU does not allow you to configure OSPF NSSAs. For example:cumulus@switch:~$ net add ospf area 0.0.0.1 nssa To work around this issue, use FRR instead. For example: switch# configure terminal | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-26181 | ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).-A FORWARD -i swp+ -j LOG You can now install such rules with swp+. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-26179 | If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error:ERROR: ‘ascii’ codec can’t encode character u’\xe9’ in position 3: ordinal not in range(128) | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-26158 | On the Mellanox switch, UFT profiles are unable to support the documented capacity for routes to addresses that are more than 64 bits in length. The listed capacities assume 64-bit destination IP addresses. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26147 | On the EdgeCore AS4610 switch, the ping command fails unless you run the command with sudo.To work around this issue, run the following commands: cumulus@switch:~$ sudo setcap cap_net_raw+ep /usr/share/mgmt-vrf/bin/ping Run the following command to verify the workaround:
You should see the following output:
| 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26146 | clagd memory consumption increases under certain unknown conditions. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-26139 | Selective ERSPAN does not work when you specify a bridge port. | 3.7.6-3.7.12 | |
| CM-26138 | You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:-A FORWARD -i swp5 -s 00:25:90:b2:bd:9d -d 50:6b:4b:96:c4:04 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64 | 3.7.6-3.7.12 | |
| CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:-A FORWARD -i vni10 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64 | 3.7.6-3.7.12 | |
| CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.12 | |
| CM-26126 | Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.12 | |
| CM-26073 | {watchfrr calls sudo /usr/sbin/service frr restart bgpd but restarts all FRR daemons which can cause a large outage. This occurs because watchfrr uses an old style service command, which causes all daemons to restart when a daemon fails. | 3.7.7-3.7.8 | 3.7.9-3.7.12 |
| CM-26024 | On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. | 3.7.7-3.7.12 | |
| CM-26022 | When using the UFT lpm-equal profile, IPv6 routes are limited to 16K. | 3.7.8 | 3.7.9-3.7.12 |
| CM-25979 | Dynamic route-leaking works as expected until FRR is restarted or the switch is rebooted. After the restart or reboot, the import RT under the VRF where routes are being imported is incorrect. | 3.7.7-3.7.8 | 3.7.9-3.7.12 |
| CM-25973 | After a remote VTEP peer link goes down, the tunnel destination IP address might be incorrect in hardware, which might cause loss of overlay communication between VTEPs. | 3.7.8-3.7.10 | 3.7.11-3.7.12 |
| CM-25956 | The following CVEs were announced in Debian Security Advisory DSA-4499-1 and affect the ghostscript package. ————————————————————————————— Debian Security Advisory DSA-4499-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso August 12, 2019 https://www.debian.org/security/faq ————————————————————————————— Package: ghostscript CVE ID: CVE-2019-10216 Debian Bug: 934638 Netanel reported that the .buildfont1 procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. For the oldstable distribution (stretch), this problem has been fixed in version 9.26a~dfsg-0+deb9u4. For the stable distribution (buster), this problem has been fixed in version 9.27~dfsg-2+deb10u1. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-25955 | Lenovo switches do not send or receive LLDP on eth0 interfaces. | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-25944 | The following CVEs were announced in Debian Security Advisory DSA-4495 and DSA 4497 and affect the linux kernel package. ——————————————————————————————— Debian Security Advisory DSA-4495-1 security@debian.org https://www.debian.org/security/ Ben Hutchings August 10, 2019 https://www.debian.org/security/faq ——————————————————————————————— Package: linux CVE ID: CVE-2018-20836 CVE-2019-1125 CVE-2019-1999 CVE-2019-10207 CVE-2019-10638 CVE-2019-12817 CVE-2019-12984 CVE-2019-13233 CVE-2019-13631 CVE-2019-13648 CVE-2019-14283 CVE-2019-14284 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2015-8553 Jan Beulich discovered that CVE-2015-2150 was not completely addressed. If a PCI physical function is passed through to a Xen guest, the guest is able to access its memory and I/O regions before enabling decoding of those regions. This could result in a denial-of-service (unexpected NMI) on the host. The fix for this is incompatible with qemu versions before 2.5. (CVE ID not yet assigned) Denis Andzakovic reported a missing type check in the IPv4 multicast routing implementation. A user with the CAP_NET_ADMIN capability (in any user namespace) could use this for denial-of-service (memory corruption or crash) or possibly for privilege escalation. CVE-2018-5995 ADLab of VenusTech discovered that the kernel logged the virtual addresses assigned to per-CPU data, which could make it easier to exploit other vulnerabilities. CVE-2018-20836 chenxiang reported a race condition in libsas, the kernel subsystem supporting Serial Attached SCSI (SAS) devices, which could lead to a use-after-free. It is not clear how this might be exploited. CVE-2019-1125 It was discovered that most x86 processors could speculatively skip a conditional SWAPGS instruction used when entering the kernel from user mode, and/or could speculatively execute it when it should be skipped. This is a subtype of Spectre variant 1, which could allow local users to obtain sensitive information from the kernel or other processes. It has been mitigated by using memory barriers to limit speculative execution. Systems using an i386 kernel are not affected as the kernel does not use SWAPGS. CVE-2019-1999 A race condition was discovered in the Android binder driver, which could lead to a use-after-free. If this driver is loaded, a local user might be able to use this for denial-of-service (memory corruption) or for privilege escalation. CVE-2019-1125 It was discovered that most x86 processors could speculatively skip a conditional SWAPGS instruction used when entering the kernel from user mode, and/or could speculatively execute it when it should be skipped. This is a subtype of Spectre variant 1, which could allow local users to obtain sensitive information from the kernel or other processes. It has been mitigated by using memory barriers to limit speculative execution. Systems using an i386 kernel are not affected as the kernel does not use SWAPGS. CVE-2019-3882 It was found that the vfio implementation did not limit the number of DMA mappings to device memory. A local user granted ownership of a vfio device could use this to cause a denial of service (out-of-memory condition). CVE-2019-3900 It was discovered that vhost drivers did not properly control the amount of work done to service requests from guest VMs. A malicious guest could use this to cause a denial-of-service (unbounded CPU usage) on the host. CVE-2019-10207 The syzkaller tool found a potential null dereference in various drivers for UART-attached Bluetooth adapters. A local user with access to a pty device or other suitable tty device could use this for denial-of-service (BU G/oops). CVE-2019-10638 Amit Klein and Benny Pinkas discovered that the generation of IP packet IDs used a weak hash function, “jhash”. This could enable tracking individual computers as they communicate with different remote servers and from different networks. The “siphash” function is now used instead. CVE-2019-10639 Amit Klein and Benny Pinkas discovered that the generation of IP packet IDs used a weak hash function that incorporated a kernel virtual address. This hash function is no longer used for IP IDs, although it is still used for other purposes in the network stack. CVE-2019-12817 It was discovered that on the PowerPC (ppc64el) architecture, the hash page table (HPT) code did not correctly handle fork() in a process with memory mapped at addresses above 512 TiB. This could lead to a use-after-free in the kernel, or unintended sharing of memory between user processes. A local user could use this for privilege escalation. Systems using the radix MMU, or a custom kernel with a 4 KiB page size, are not affected. CVE-2019-12984 It was discovered that the NFC protocol implementation did not properly validate a netlink control message, potentially leading to a null pointer dereference. A local user on a system with an NFC interface could use this for denial-of-service (BUG/oops). CVE-2019-13233 Jann Horn discovered a race condition on the x86 architecture, in use of the LDT. This could lead to a use-after-free. A local user could possibly use this for denial-of-service. CVE-2019-13631 It was discovered that the gtco driver for USB input tablets could overrun a stack buffer with constant data while parsing the device’s descriptor. A physically present user with a specially constructed USB device could use this to cause a denial-of-service (BUG/oops), or possibly for privilege escalation. CVE-2019-13648 Praveen Pandey reported that on PowerPC (ppc64el) systems without Transactional Memory (TM), the kernel would still attempt to restore TM state passed to the sigreturn() system call. A local user could use this for denial-of-service (oops). CVE-2019-14283 The syzkaller tool found a missing bounds check in the floppy disk driver. A local user with access to a floppy disk device, with a disk present, could use this to read kernel memory beyond the I/O buffer, possibly obtaining sensitive information. CVE-2019-14284 The syzkaller tool found a potential division-by-zero in the floppy disk driver. A local user with access to a floppy disk device could use this for denial-of-service (oops). (CVE ID not yet assigned) Denis Andzakovic reported a possible use-after-free in the TCP sockets implementation. A local user could use this for denial-of-service (memory corruption or crash) or possibly for privilege escalation. (CVE ID not yet assigned) The netfilter conntrack subsystem used kernel addresses as user-visible IDs, which could make it easier to exploit other security vulnerabilities. XSA-300 Julien Grall reported that Linux does not limit the amount of memory which a domain will attempt to baloon out, nor limits the amount of “foreign / grant map” memory which any individual guest can consume, leading to denial of service conditions (for host or guests). For the oldstable distribution (stretch), these problems have been fixed in version 4.9.168-1+deb9u5. For the stable distribution (buster), these problems have been fixed in version 4.19.37-5+deb10u2. For the oldstable distribution (stretch), these problems will be fixed soon. We recommend that you upgrade your linux packages. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-25923 | The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. | 3.7.8-3.7.12 | |
| CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.12 | |
| CM-25859 | The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. | 3.7.7-3.7.12 | |
| CM-25824 | NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.12 | |
| CM-25796 | Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:ifdown vlan123 ; sleep 2 ; ifup vlan123 You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. | 3.7.5-3.7.12 | |
| CM-25794 | Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.12 | |
| CM-25784 | The following CVEs were announced in Debian Security Advisory DSA-4489-1. ————————————————————————————— Debian Security Advisory DSA-4489-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso July 27, 2019 https://www.debian.org/security/faq ————————————————————————————— Package: patch CVE ID: CVE-2019-13636 CVE-2019-13638 Debian Bug: 932401 933140 Imre Rad discovered several vulnerabilities in GNU patch, leading to shell command injection or escape from the working directory and access and overwrite files, if specially crafted patch files are processed. This update includes a bugfix for a regression introduced by the patch to address CVE-2018-1000156 when applying an ed-style patch (#933140). For the oldstable distribution (stretch), these problems have been fixed in version 2.7.5-1+deb9u2. For the stable distribution (buster), these problems have been fixed in version 2.7.6-3+deb10u1. We recommend that you upgrade your patch packages. For the detailed security status of patch please refer to its security tracker page at: https://security-tracker.debian.org/tracker/patch | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-25783 | Cumulus Linux installer images have a shell script that validates checksum integrity. When you run onie-install, this check is run but the installer is still staged even if the checksum validation fails.To work around this issue, perform your own checksum validation before staging a new image with onie-install. | 3.7.7-3.7.8 | 3.7.9-3.7.12 |
| CM-25770 | On a Tomahawk switch, the 5m 40G DACs (40G CR4) do not come up when both sides have auto-negotiation enabled. | 3.7.7-3.7.8 | 3.7.9-3.7.12 |
| CM-25766 | On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. | 3.7.7-3.7.12 | |
| CM-25754 | A port that is used as both a double tag interface and a VXLAN access side interface does not forward correctly; VXLAN decapsulation is does not occur. However, do not configure double tagged interfaces on VXLAN uplink ports as this will cause VXLAN routing issues. | 3.6.2-3.7.8 | 3.7.9-3.7.12 |
| CM-25747 | When transitioning from a down state to an up state due to peerlink failure and recovery, MLAG does not start the initDelay timer before trying to bring everything back up. | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:cumulus@switch:~$ net add bridge mybridge vlan-protocol 802.1ad | 3.7.6-3.7.12 | |
| CM-25735 | When MLAG is re-establishing its peering after a member reboot, the VNIs on the peer briefly go into a protodown state. This can cause complete downtime to dually connected hosts as the member coming back up is still in initDelay. This issue does resolve itself as the VNIs do come back up within ten seconds. | 3.7.8 | 3.7.9-3.7.12 |
| CM-25718 | IF-MIB::ifHCInOctets reports significantly lower values than reported by interface counters seen elsewhere. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25694 | If a packet is policed by ebtables, it does not increment an ACL drop on the ingress interface. Instead, it increments the TDBGC3/6 drop counter to the CPU. | 3.7.6-3.7.12 | |
| CM-25693 | After you issue the NCLU net del bgp vrf <vrf> autonomous-system <AS> command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-25684 | For interfaces configured with RS FEC, when switchd is restarted, the link goes down but does not automatically come back up. This occurs because the FEC status is not replayed correctly into the kernel.To work around this issue, run the ifreload -a command to bring up the interface after switchd is restarted. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25674 | On Mellanox switches, policer iptables are not working as expected. For example, when using a policer with mode KB/MB/GB to rate-limit interfaces, the syntax is accepted but the data plane transfer speed is not affected by the rule. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25672 | snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. | 3.7.4-3.7.10 | 3.7.11-3.7.12 |
| CM-25665 | On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur:
| 3.7.5-3.7.11 | 3.7.12 |
| CM-25664 | On the Trident3 platform, you can only add 50 percent of the total ECMP next hops. A log message indicates that the table is full. | 3.7.7-3.7.8 | 3.7.9-3.7.12 |
| CM-25646 | When moving an IP address from the address line to inet dhcp, then issuing the ifreload -a command, the old address is not removed from the interface. NCLU still reports the old address only and reports it as a DHCP address. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25641 | If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl.To work around this issue, power cycle the switch. | 3.7.6-3.7.12 | |
| CM-25640 | When you configure the switch to send an EAP request with the net add dot1x send-eap-request-id command, the switch ignores re-authentication attempts and does not send back an EAPol. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25619 | After configuring switchd hal.bcm.per_vlan_router_mac_lookup to TRUE on a Broadcom switch, layer 2 traffic works over VXLAN but the host is not able to ping the locally connected gateway and loses routing ability to other IPs and subnets. | 3.6.0-3.7.8 | 3.7.9-3.7.12 |
| CM-25610 | BGP update packets are sometimes missing the mandatory nexthop attribute, which causes connections to reset. For example, this issue is seen when using VRF route leaking with a mix of BGP unnumbered and BGP numbered peers. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25505 | In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result. In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example:
| 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25489 | When BGP remove-private-AS replace-AS is configured under the BGP IPv4 or IPv6 address family between a pair of switches configured as BGP peers, a BGP route update might cause the BGP session to flap.To work around this issue, do not configure remove-private-AS replace-AS in the BGP IPv4 or IPv6 address family. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25467 | The following CVEs were announced in Debian Security Advisory DSA-4472-1 and affect the expat (libexpat1) package. ————————————————————————————- Debian Security Advisory DSA-4472-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso June 28, 2019 https://www.debian.org/security/faq ————————————————————————————- Package: expat CVE ID: CVE-2018-20843 Debian Bug: 931031 It was discovered that Expat, an XML parsing C library, did not properly handled XML input including XML names that contain a large number of colons, potentially resulting in denial of service. For the stable distribution (stretch), this problem has been fixed in version 2.2.0-2+deb9u2. We recommend that you upgrade your expat packages. For the detailed security status of expat, refer to its security tracker page at: https://security-tracker.debian.org/tracker/expat | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-25447 | When you define a trap destination using @mgmt, snmpd indicates that the network is unreachable even though the IP address is reachable in the management VRF.To work around this issue, remove @mgmt vrf references in the /etc/snmp/snmpd.conf file, stop snmpd, then start snmpd manually in the management VRF with the systemctl start snmpd@mgmt command. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25432 | The snmpd service frequently crashes due to double free or corruption. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25417 | The IP neighbor entry for a link-local next hop (169.254.x.x) is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which can be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. | 3.7.7-3.7.8 | 3.7.9-3.7.12 |
| CM-25414 | On the Mellanox SN2410 switch, switchd does not start. | 3.7.2-3.7.8 | 3.7.9-3.7.12 |
| CM-25404 | hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. | 3.7.6-3.7.12 | |
| CM-25400 | If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. | 3.7.6-3.7.12 | |
| CM-25397 | When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. | 3.7.3-3.7.12 | |
| CM-25395 | When you run the NCLU net del all command, the exec-timeout setting changes in the /etc/frr.frr.conf file. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25376 | When you generate a cl-support file, clagd.service prints log messages similar to the following:019-03-21T07:18:15.727581+00:00 leaf01 clagd[20912]: DumpThreadStacks - start 2019-03-21T07:18:15.728157+00:00 leaf01 clagd[20912]: #012thread: CollectSysInfo (140608446367488) 2019-03-21T07:18:15.735986+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 783, in __bootstrap 2019-03-21T07:18:15.736585+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 810, in __bootstrap_inner 2019-03-21T07:18:15.737045+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 763, in run 2019-03-21T07:18:15.737933+00:00 leaf01 clagd[20912]: file: /usr/sbin/clagd, line 930, in CollectSysInfoT 2019-03-21T07:18:15.739527+00:00 leaf01 clagd[20912]: file: /usr/sbin/clagd, line 187, in CollectSysInfo 2019-03-21T07:18:15.740540+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 621, in wait 2019-03-21T07:18:15.742293+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/dist-packages/clag/clagthread.py, line 48, in wait . . 2019-03-21T07:18:16.456061+00:00 leaf01 clagd[20912]: DumpThreadStacks - end | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25358 | When you configure the link-down yes attribute to a physical SVI, the VRR (-v0) interface is not brought down, and the locally-connected subnet can still be redistributed into routing protocols and advertised to neighbors despite the physical SVI being administratively down.To work around this issue, manually bring down the VRR (-v0) interface with the ip link set dev command. For example:cumulus@switch:~$ sudo ip link set dev vlan1755-v0 down | 3.6.1-3.7.8 | 3.7.9-3.7.12 |
| CM-25343 | The following CVEs were announced in Debian Security Advisory DSA-4465-1 and affect the linux kernel. ——————————————————————————————- Debian Security Advisory DSA-4465-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso June 17, 2019 https://www.debian.org/security/faq ——————————————————————————————- Package: linux CVE ID: CVE-2019-3846 CVE-2019-5489 CVE-2019-9500 CVE-2019-9503 CVE-2019-10126 CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 CVE-2019-11486 CVE-2019-11599 CVE-2019-11815 CVE-2019-11833 CVE-2019-11884 Debian Bug: 928989 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2019-3846, CVE-2019-10126 huangwen reported multiple buffer overflows in the Marvell wifi (mwifiex) driver, which a local user could use to cause denial of service or the execution of arbitrary code. CVE-2019-5489 Daniel Gruss, Erik Kraft, Trishita Tiwari, Michael Schwarz, Ari Trachtenberg, Jason Hennessey, Alex Ionescu, and Anders Fogh discovered that local users could use the mincore() system call to obtain sensitive information from other processes that access the same memory-mapped file. CVE-2019-9500, CVE-2019-9503 Hugues Anguelkov discovered a buffer overflow and missing access validation in the Broadcom FullMAC wifi driver (brcmfmac), which a attacker on the same wifi network could use to cause denial of service or the execution of arbitrary code. CVE-2019-11477 Jonathan Looney reported that a specially crafted sequence of TCP selective acknowledgements (SACKs) allows a remotely triggerable kernel panic. CVE-2019-11478 Jonathan Looney reported that a specially crafted sequence of TCP selective acknowledgements (SACKs) will fragment the TCP retransmission queue, allowing an attacker to cause excessive resource usage. CVE-2019-11479 Jonathan Looney reported that an attacker could force the Linux kernel to segment its responses into multiple TCP segments, each of which contains only 8 bytes of data, drastically increasing the bandwidth required to deliver the same amount of data. This update introduces a new sysctl value to control the minimal MSS (net.ipv4.tcp_min_snd_mss), which by default uses the formerly hard-coded value of 48. We recommend raising this to 536 unless you know that your network requires a lower value. CVE-2019-11486 Jann Horn of Google reported numerous race conditions in the Siemens R3964 line discipline. A local user could use these to cause unspecified security impact. This module has therefore been disabled. CVE-2019-11599 Jann Horn of Google reported a race condition in the core dump implementation which could lead to a use-after-free. A local user could use this to read sensitive information, to cause a denial of service (memory corruption), or for privilege escalation. CVE-2019-11815 It was discovered that a use-after-free in the Reliable Datagram Sockets protocol could result in denial of service and potentially privilege escalation. This protocol module (rds) is not auto-loaded on Debian systems, so this issue only affects systems where it is explicitly loaded. CVE-2019-11833 It was discovered that the ext4 filesystem implementation writes uninitialised data from kernel memory to new extent blocks. A local user able to write to an ext4 filesystem and then read the filesystem image, for example using a removable drive, might be able to use this to obtain sensitive information. CVE-2019-11884 It was discovered that the Bluetooth HIDP implementation did not ensure that new connection names were null-terminated. A local user with CAP_NET_ADMIN capability might be able to use this to obtain sensitive information from the kernel stack. For the stable distribution (stretch), these problems have been fixed in version 4.9.168-1+deb9u3. We recommend that you upgrade your linux packages. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25298 | The following CVEs were announced in a Debian Security Advisory that affects vim modelines. Package: vim and neovim CVE ID: CVE-2019-12735 Debian Bugs: 930020, 930024 getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim. For the detailed security status, refer to the security tracker page at: https://security-tracker.debian.org/tracker/CVE-2019-12735 https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12735.html https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md Cumulus Networks recommends that you disable modelines in the the vimrc file (set nomodeline) to use the securemodelines plugin or to disable modelineexpr (since patch 8.1.1366, Vim-only) to disallow expressions in modelines.To check if you have modelines enabled, open vim and enter: :set modeline? If vim returns nomodeline, you are not vulnerable. If you are vulnerable or you want to ensure your security with this issue, add these lines to your vimrc file:set modelines=0 set nomodeline modeline is enabled by default. Verify that you do not have any existing lines in .vimrc that set modelines or modeline. | 3.0.0-3.7.10 | 3.7.11-3.7.12 |
| CM-25295 | The ifquery command should return a non-zero value if there is a syntax error. However, it currently returns zero. This issue affects automation scripts that validate a file before copying it into place. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25284 | If you configure a sys-mac with a single digit, ifreload -a does not indicate that the MAC address is invalid for the MLAG sys-mac and the clagd process fails silently. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25240 | If the address-virtual MAC address is missing a leading zero in the last octet, the interface bounces. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25079 | The snmpd service exits with a message similar to the following:Error in ‘/usr/sbin/snmpd’: double free or corruption (fasttop): 0x00000000018a4e50 *** This problem might occur during or after network convergence events. For example, when bgpd needs to process a high number of updates and the CPU cannot keep up, bgpd is disconnected and agentx generates a core dump in snmpd due to a memory allocation problem.To work around this issue, disable agentx by commenting out the following lines in the /etc/snmp/snmpd.conf file. Then, restart the snmpd service with the systemctl restart snmpd command.agentxperms 777 777 snmp snmp agentxsocket /var/agentx/master If you still want to poll the BGP4-MIB information, re-enable the bgp pass persist script by adding the following line in the /etc/snmp/snmpd.conf file:pass_persist 1.3.6.1.2.1.15 /usr/share/snmp/bgp4_pp.py | 3.7.2-3.7.8 | 3.7.9-3.7.12 |
| CM-25001 | The following CVEs were announced in Debian Security Advisory DSA-444-1, DSA-4447-1 and affect the linux kernel and microcode. Package: linux CVE ID: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 Multiple researchers have discovered vulnerabilities in the way the Intel processor designs have implemented speculative forwarding of data filled into temporary microarchitectural structures (buffers). This flaw could allow an attacker controlling an unprivileged process to read sensitive information, including from the kernel and all other processes running on the system or cross guest/host boundaries to read host memory. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details. To fully resolve these vulnerabilities it is also necessary to install updated CPU microcode. Contact your hardware ndor for microcode uppdates. In addition, this update includes a fix for a regression causing deadlocks inside the loopback driver. Fixed in version 4.19.76-1+cl4u1 | 3.0.0-3.7.12 | |
| CM-24963 | The following CVEs were announced in Debian Security Advisory DSA-4440-1. ————————————————————————————— Debian Security Advisory DSA-4440-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff May 09, 2019 https://www.debian.org/security/faq ————————————————————————————— Package: bind9 CVE ID: CVE-2018-5743 CVE-2018-5745 CVE-2019-6465 Multiple vulnerabilities were found in the BIND DNS server: CVE-2018-5743 Connection limits were incorrectly enforced. CVE-2018-5745 The “managed-keys” feature was susceptible to denial of service by triggering an assert. CVE-2019-6465 ACLs for zone transfers were incorrectly enforced for dynamically loadable zones (DLZs). For the stable distribution (stretch), these problems have been fixed in version 1:9.10.3.dfsg.P4-12.3+deb9u5. We recommend that you upgrade your bind9 packages. For the detailed security status of bind9 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/bind9 | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-24894 | The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. | 3.7.5-3.7.12 | |
| CM-24803 | On the Dell N3048EP-ON or the Delta AG6248 switch, when you execute the following command, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The Cumulus Linux image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new Cumulus Linux image.The workaround only works when an out-of-band network is present. | 3.7.6-3.7.12 | |
| CM-24799 | On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. | 3.7.5-3.7.12 | |
| CM-24784 | NCLU is unable to delete a BGP neighbor configuration if there is a VRF VNI mapping in the /etc/frr/frr.conf file. For example, the following NCLU command produces an error:cumulus@leaf01$ net del bgp neighbor swp5 interface peer-group spine ‘router bgp 65001’ configuration does not have ‘neighbor swp5 interface peer-group spine’ | 3.7.7-3.7.8 | 3.7.9-3.7.12 |
| CM-24751 | On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. | 3.7.3-3.7.12 | |
| CM-24703 | The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.12 | |
| CM-24686 | On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. | 3.7.3-3.7.12 | |
| CM-24652 | In an EVPN environment, the centralized MAC address is not installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN. This issue does not affect a pure distributed routing (symmetric or asymmetric) environment or a pure centralized routing environment. | 3.7.0-3.7.12 | |
| CM-24618 | If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:ERROR: No closing quotation See /var/log/netd.log for more details. | 3.6.1-3.7.12 | |
| CM-24593 | On a Dell S5248F (Trident3) switch, packets from switch ports are forwarded to the CPU and are sometimes corrupted. The corruption might result in BGP peerings being down, which can lead to all VXLAN traffic to and from a node to be lost, causing an outage to dually connected hosts in a rack. To work around this issue, restart switchd. | 3.7.3-3.7.8 | 3.7.9-3.7.12 |
| CM-24544 | If the clagd-vxlan-anycast-ip is removed from the /etc/network/interfaces file (either with the NCLU command or by editing the file manually), MLAG still believes it is present until clagd restarts. | 3.7.3-3.7.8 | 3.7.9-3.7.12 |
| CM-24473 | SNMP incorrectly requires engine ID specification. | 3.7.4-3.7.12 | |
| CM-24440 | bgpd creates a core dump at zclient_send_interface_radv_req. This is an issue with how FRRouting checks next hops and has been pushed upstream to FRRouting. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-24435 | When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect: net add routing route-map Proxy-ARP permit 25 match interface swp9-10 These commands are correct: net add routing route-map Proxy-ARP permit 25 match interface swp9 net add routing route-map Proxy-ARP permit 30 match interface swp10 | 3.7.2-3.7.12 | |
| CM-24426 | NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf <name> command just displays
Tab completion for the net add vrf <name> ip address <address> command works correctly. | 3.7.4-3.7.12 | |
| CM-24379 | On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.12 | |
| CM-24343 | The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. | 3.7.4-3.7.12 | |
| CM-24332 | On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. | 3.7.3-3.7.12 | |
| CM-24272 | When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface br0.100 switch(config-if)# vrrp 1 priority 110 switch(config-if)# vrrp 1 advertisement-interval switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24271 | On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface vlan100 switch(config-if)# vrrp 1 priority 110 switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24270 | Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface swp4 switch(config-if)# vrrp 1 version 2 switch(config-if)# no vrrp 1 preempt switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24262 | NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto <iface> lines exist. | 3.7.3-3.7.12 | |
| CM-24241 | When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:cumulus@switch:~$ net del bgp neighbor fabric peer-group ‘router bgp 65001’ configuration does not have ‘neighbor fabric peer-group’ | 3.7.2-3.7.12 | |
| CM-24222 | When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. | 3.7.0-3.7.12 | |
| CM-24035 | On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. | 3.7.2-3.7.12 | |
| CM-23825 | The net add interface <interface> ptm-enable command adds no ptm-enable for that interface in the frr.conf file.Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. | 3.7.2-3.7.12 | |
| CM-23792 | When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table.To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev <interface> command. | 3.7.0-3.7.12 | |
| CM-23696 | IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. | 3.7.2-3.7.12 | |
| CM-23665 | NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan <layer3-vni> bridge access <vlan>. This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.To restore connectivity, remove the VLAN ID from the bridge. | 3.7.2-3.7.12 | |
| CM-23661 | On the Mellanox switch, when you configure a GRE tunnel, the traffic behind the local tunnel endpoint destined through the GRE tunnel is software-forwarded. | 3.7.2-3.7.12 | |
| CM-23652 | The NCLU command net show bridge spanning-tree does not show the MLAG peer link as part of the STP forwarding instance.To work around this issue, use the mstpctl command to confirm the STP status of the port. | 3.7.2-3.7.8 | 3.7.9-3.7.12 |
| CM-23651 | In an EVPN symmetric routing configuration, when an IP address is frozen, kernel neighbor table information and kernel VRF routing table information about the frozen IP address might be out-of-sync. | 3.7.3-3.7.12 | |
| CM-23636 | The following CVEs were announced in Debian Security Advisory DSA-4436-1 and affect the imagemagick packages. ——————————————————————————————- Debian Security Advisory DSA-4371-1 security@debian.org https://www.debian.org/security/ Yves-Alexis Perez January 22, 2019 https://www.debian.org/security/faq ——————————————————————————————- Max Justicz discovered a vulnerability in APT, the high level package manager. The code handling HTTP redirects in the HTTP transport method doesn’t properly sanitize fields transmitted over the wire. This vulnerability could be used by an attacker located as a man-in-the-middle between APT and a mirror to inject malicous content in the HTTP connection. This content could then be recognized as a valid package by APT and used later for code execution with root privileges on the target machine. Since the vulnerability is present in the package manager itself, it is recommended to disable redirects in order to prevent exploitation during this upgrade only, using: apt -o Acquire::http::AllowRedirect=false update apt -o Acquire::http::AllowRedirect=false upgrade The code handling HTTP redirects in the HTTP transport method doesn’t properly sanitize fields transmitted over the wire. This vulnerability could be used by an attacker located as a man-in-the-middle between APT and a mirror to inject malicous content in the HTTP connection. This content could then be recognized as a valid package by APT and used later for code execution with root privileges on the target machine. Since the vulnerability is present in the package manager itself, it is recommended to disable redirects in order to prevent exploitation during this upgrade only, using: apt -o Acquire::http::AllowRedirect=false update apt -o Acquire::http::AllowRedirect=false upgrade This is known to break some proxies when used against security.debian.org. If that happens, people can switch their security APT source to use deb http://cdn-fastly.deb.debian.org/debian-security stable/updates main For the stable distribution (stretch), this problem has been fixed in version 1.4.9. | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-23584 | When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. | 3.7.2-3.7.12 | |
| CM-23570 | On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. | 3.7.2-3.7.12 | |
| CM-23523 | Modifying the /etc/netd.conf file to set show_linux_command = True does not take effect. | 3.7.2-3.7.8 | 3.7.9-3.7.12 |
| CM-23431 | On the Trident3 switch, the input chain ACLs drop action forwards packets if the traffic is destined to the CPU on an SVI. | 3.6.2-3.7.8 | 3.7.9-3.7.12 |
| CM-23422 | portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. | 3.7.0-3.7.12 | |
| CM-23418 | For QSFP modules, the sudo ifdown command does not disable the Tx laser. | 3.7.2-3.7.12 | |
| CM-23417 | If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. | 3.7.0-3.7.12 | |
| CM-23398 | The following CVEs were announced in Debian Security Advisory DSA-4359-1 and affect the wireshark packages, some of which are available for optional installation on Cumulus Linux: CVE ID: CVE-2018-12086 CVE-2018-18225 CVE-2018-18226 CVE-2018-18227 CVE-2018-19622 CVE-2018-19623 CVE-2018-19624 CVE-2018-19625 CVE-2018-19626 CVE-2018-19627 CVE-2018-19628 All CVEs except for CVE-2018-12086 are fixed in Cumulus Linux 3.7.9. Packages: libwireshark5, libwireshark-data, libwiretap8, libwscodecs2, libwsutil9, tshark, wireshark, wireshark-common, wireshark-doc These problems have been fixed in version 1.12.1+g01b65bf-4+deb8u19 We recommend that you upgrade your wireshark packages. For the detailed security status of wireshark, refer to its security tracker page at: https://security-tracker.debian.org/tracker/wireshark | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-23397 | On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. | 3.6.2-3.7.12 | |
| CM-23285 | When you remove an interface from a bridge and add it to a VRF in the same commit/ifreload, the IPv6 link-local address is not created automatically. To work around this issue, do the change in two separate commits. First, remove the interface from the bridge, which causes it to be a layer 2 interface. Then, enslave the interface to the VRF. | 3.7.2-3.7.8 | 3.7.9-3.7.12 |
| CM-23125 | The OpenSSL package on Cumulus Linux 3.x has a vulnerability similar to CVE-2018-0734. (The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key). According to Debian upstream, this version “is not vulnerable [to CVE-2018-0734 exactly]. Nevertheless, there is a bug fix that futher reduces the amount of leaked timing information. It got no CVE on its own and introduced this vulnerability.“ Vulnerable on CL3: 1.0.1t-1+deb8u12 | 3.0.0-3.7.12 | |
| CM-23123 | When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. | 3.7.2-3.7.12 | |
| CM-23114 | The following CVEs were announced in Debian Security Advisory DSA-4347-1. ————————————————————————————————– Debian Security Advisory DSA-4347-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso November 29, 2018 https://www.debian.org/security/faq ————————————————————————————————– Package: perl CVE ID: CVE-2018-18311 CVE-2018-18312 CVE-2018-18313 CVE-2018-18314 Multiple vulnerabilities were discovered in the implementation of the Perl programming language. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2018-18311 Jayakrishna Menon and Christophe Hauser discovered an integer overflow vulnerability in Perl_my_setenv leading to a heap-basedbuffer overflow with attacker-controlled input. CVE-2018-18312 Eiichi Tsukata discovered that a crafted regular expression could cause a heap-based buffer overflow write during compilation, potentially allowing arbitrary code execution. CVE-2018-18313 Eiichi Tsukata discovered that a crafted regular expression could cause a heap-based buffer overflow read during compilation which leads to information leak. CVE-2018-18314 Jakub Wilk discovered that a specially crafted regular expression could lead to a heap-based buffer overflow. For the stable distribution (stretch), these problems have been fixed in version 5.24.1-3+deb9u5. We recommend that you upgrade your perl packages. For the detailed security status of perl please refer to its security tracker page at: https://security-tracker.debian.org/tracker/perl | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-23096 | The following CVEs were announced in Debian Security Advisory DSA-4372-1. ————————————————————————————————– Debian Security Advisory DSA-4346-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso November 27, 2018 https://www.debian.org/security/faq ————————————————————————————————– Package: ghostscript CVE ID: CVE-2018-19409 CVE-2018-19475 CVE-2018-19476 CVE-2018-19477 Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service or the execution of arbitrary code if a malformed Postscript file is processed (despite the -dSAFER sandbox being enabled). This update rebases ghostscript for stretch to the upstream version 9.26 which includes additional changes. For the stable distribution (stretch), these problems have been fixed in version 9.26~dfsg-0+deb9u1. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript please refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-23075 | There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:2018-11-10T23:35:30.992370-08:00 Dev dhcrelay: Listening on LPF/vlan.101/a0:00:00:00:00:51 2018-11-10T23:35:30.993472-08:00 Dev dhcrelay: Sending on LPF/vlan.101/a0:00:00:00:00:51 Eventually the dhcrelay service stops. | 3.7.1-3.7.12 | |
| CM-23021 | When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. | 3.7.1-3.7.12 | |
| CM-23016 | When FRR restarts, snmp<span class="error">[err]</span> dev/kmem: Permission denied error messages are recorded in the log file and SNMPd might crash periodically. | 3.7.5-3.7.10 | 3.7.11-3.7.12 |
| CM-23004 | The local fallback account authenticates using the local password when the RADIUS or TACACS service is up. The expected behavior is for this to fail and only succeed when the RADIUS OR TACACS server fails to respond. | 3.7.1-3.7.12 | |
| CM-22937 | NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation.To work around this issue, stop snmpd, remove the cache file, then restart snmpd. | 3.6.0-3.7.12 | |
| CM-22849 | When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur.This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. | 3.7.2-3.7.12 | |
| CM-22834 | In rare cases, certain IPv6 BGP peers fail to reestablish after switchd restarts. | 3.7.2-3.7.8 | 3.7.9-3.7.12 |
| CM-22808 | When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. | 3.5.2-3.7.12 | |
| CM-22794 | The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. | 3.6.2-3.7.12 | |
| CM-22608 | Mellanox Spectrum and Helix4 switches occasionally send malformed packets and do not send any flow samples (only counters). While this issue is fixed for switches with the Spectrum ASIC, this is a known limitation on this Helix4 platform. | 3.6.2-3.7.8 | 3.7.9-3.7.12 |
| CM-22605 | On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0.To work around this issue:
| 3.5.3-3.7.10 | 3.7.11-3.7.12 |
| CM-22591 | CVE-2018-5391 (FragmentSmack) is a network vulnerability where an attacker can trigger time and calculation expensive fragment reassembly with specially crafted packets, leading to a denial of service. On a Cumulus Linux switch, the impact is limited to control plane and management plane traffic. Any control plane traffic coming in the front panel ports will be limited by existing policer ACLs. To work around this issue, create a file called /etc/sysctl.d/ip.conf and add these settings:net.ipv4.ipfrag_low_thresh = 196608 | 3.7.0-3.7.11 | 3.7.12 |
| CM-22583 | Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. | 3.6.0-3.7.12 | |
| CM-22554 | If you try to bring down several members of a bond remotely at the same time, the link state of one of the interfaces might not transition correctly to the down state; however, all links show down in hardware. | 3.6.2-3.7.12 | |
| CM-22538 | When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:/etc/frr/daemons was modified by another user. Despite this error, the change is made and the description is removed from the frr.conf file. | 3.6.2-3.7.10 | 3.7.11-3.7.12 |
| CM-22386 | The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. | 3.7.0-3.7.12 | |
| CM-22301 | For an unresolved address, the IPROUTER default policer rule has been modified to not match on packets exiting a TUNNEL and headed to the CPU to resolve the address via ARP. As a result, the following default rule no longer matches TUNNEL ingress packets.A $INGRESS_CHAIN –in-interface $INGRESS_INTF -m addrtype –dst-type IPROUTER -j POLICE –set-mode pkt –set-rate 400 –set-burst 100 These packets are now policed by catch all rules. To work around this issue, the VPORT value on a TRIDENT switch must be changed from binary 011 to 100. | 3.6.1-3.7.12 | |
| CM-22287 | On the EdgeCore AS7712 (Tomahawk) switch running in atomic mode, when a layer 3 ECMP path is brought down, traffic traversing the path stops working for about four seconds. When the switch is changed to non-atomic mode, the delay is less than one second. This issue is seen across OSPF and static ECMP routes. | 3.6.2-3.7.12 | |
| CM-22277 | On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-22274 | To ease interoperation with non-Cumulus devices, it is possible to configure the route-target import and export values under the layer 2 VNI EVPN configuration. The same configuration does not work for both layer 2 VNI and layer 3 VNIs. Set the EVPN address-family within the VNI context when configuring the route-target in the layer 2 VNI. Set the EVPN address-family without the VNI context when configuring the route-target in the layer 3 VNI. | 3.6.0-3.7.12 | |
| CM-22252 | On the Edgecore OMP-800, there is no Power Supply information from the sensor or from smonctl. The platform driver has support for the PSUs but this was not added to the sensors infrastructure.This is a known limitation on the OMP-800 platform. | 3.6.2-3.7.12 | |
| CM-22228 | On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.12 | |
| CM-22205 | If a user is in vtysh when FRR is restarted, the running configuration in that vtysh session shows empty. | 3.6.2-3.7.12 | |
| CM-22203 | By default, the nginx server used for the HTTP API on port 8080 is enabled, but does not listen to external requests. However, it appears to be listening and answering external requests. | 3.6.1-3.7.8 | 3.7.9-3.7.12 |
| CM-22138 | When you run the NCLU net show system command or the NetQ netq inventory command on the Edgecore OMP-800 switch, the output does not show any port or chip information. | 3.6.2-3.7.12 | |
| CM-22041 | At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. | 3.4.3-3.7.12 | |
| CM-22020 | On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. | 3.7.0-3.7.12 | |
| CM-21927 | When running ifreload on Mellanox Spectrum devices, after updating an interface configuration, sometimes VLANs are not programmed into the hardware data plane. The Linux control plane looks normal but the VLAN has not been programmed into the hardware and packets that arrive for the VLAN might be dropped.To work around this issue, remove and re-add the affected VLANs from the port. | 3.5.3-3.7.12 | |
| CM-21898 | On a Trident3 switch, IGMP packets are not policed by the police rule in the 00control ACL file. The packets are policed by the catchall policer in the 99control ACL file instead.-A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police --set-mode pkt --set-rate 100 --set-burst 100To work around this issue, let the CPU bound IGMP packet hit the following rule and change the policer rate to a desired value for IGMP packets: -A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police --set-mode pkt --set-rate 100 --set-burst 100Typically, the destination MAC address 01:00:5e:xx:xx:xx is used only for PIM/IGMP control and data stream packets. However, this workaround cannot handle data stream multicast packets that are not TCP/UDP; this is not typically done. | 3.6.2-3.7.12 | |
| CM-21785 | The source address of the ICMPv6 time exceeded message (traceroute hop) is sourced from the wrong VRF when the traceroute target resides on the same switch but in a different VRF. | 3.6.2-3.7.12 | |
| CM-21769 | On the Mellanox switch, GRE tunneling does not work if the tunnel source is configured on an SVI interface. If the tunnel source is configured on a physical switch port, then tunneling works as expected. | 3.6.1-3.7.12 | |
| CM-21678 | On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty: cumulus@switch:~$ netq show sensors temp changes | grep absent | grep -v psu P2Leaf01 temp9 networking asic die temp sensor absent 43 105 100 5 Unable to find driver path: /cumulu Add 7d:22h:1m:41s P2Leaf01 temp6 networking asic die temp sensor absent 45 105 100 5 Unable to find driver path: /cumulu Add 7d:22h:1m:41s P2Leaf01 temp6 networking asic die temp sensor absent 47 105 100 5 Unable to read temp4_highest Add 9d:23h:26m:6s P2Leaf01 temp6 networking asic die temp sensor absent 45 105 100 5 Unable to read temp4_highest Add 14d:22h:46m:45s This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response. | 3.5.3-3.7.12 | |
| CM-21667 | FRR does not add BGP ttl-security to either the running configuration or to the /etc/frr/frr.conf file when configured on a peer group instead of a specific neighbor.To work around this issue, add ttl-security to individual neighbors instead of the peer group. | 3.6.1-3.7.12 | |
| CM-21511 | If a VNI is configured before the bridge in /etc/network/interfaces, the switch does not send IGMP queries.To work around this issue, edit the /etc/network/interfaces file to define the bridge before the VNI. For example:# The primary network interface auto eth0 iface eth0 inet dhcp auto lo iface lo inet loopback address 10.26.10.11/32 auto swp9 iface swp9 bridge-access 100 auto swp10 iface swp10 bridge-access 100 auto bridge iface bridge bridge-ports swp9 swp10 vni-10 bridge-vids 100 bridge-vlan-aware yes bridge-mcquerier 1 auto vni-10 iface vni-10 vxlan-id 10 vxlan-local-tunnelip 10.0.0.11 bridge-access 100 auto bridge.100 vlan bridge.100 bridge-igmp-querier-src 123.1.1.1 auto vlan100 iface vlan100 address 10.26.100.2/24 vlan-id 100 vlan-raw-device bridge . | 3.6.1-3.7.8 | 3.7.9-3.7.12 |
| CM-21379 | If a primary route becomes unavailable (for example, you run ifdown on the switch port), the backup route remains inactive and is not installed into FIB.To work around this issue, configure routes as ECMP: cumulus@switch:~$ net del routing route 4.1.1.0/24 1.1.1.1 10 cumulus@switch:~$ net add routing route 4.1.1.0/24 1.1.1.1 cumulus@switch:~$ net commit | 3.5.3-3.7.12 | |
| CM-21373 | Debian issued the following security advisory, DSA-4231-1, which affects the libgcrypt20 package. This advisory applies only to the the Debian Stretch release. Debian Jessie, upon which Cumulus Linux 3.0 - 3.6.2 is based, is vulnerable. CVE-2018-0495 It was discovered that Libgcrypt is prone to a local side-channel attack allowing recovery of ECDSA private keys. For the stable distribution (stretch), this problem has been fixed in version 1.7.6-2+deb9u3. We recommend that you upgrade your libgcrypt20 packages. For the detailed security status of libgcrypt20, refer to its security tracker page at: https://security-tracker.debian.org/tracker/libgcrypt20 | 3.6.2-3.7.10 | 3.7.11-3.7.12 |
| CM-21332 | When two VLAN subinterfaces are bridged to each other in a traditional mode bridge, switchd doesn’t assign a gport to the subinterface, even though a gport is expected for each VLAN subinterface.To work around this issue, you can do one of two things:
| 3.5.3-3.7.12 | |
| CM-21278 | The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment. | 3.5.3-3.7.10 | 3.7.11-3.7.12 |
| CM-21058 | The advertised routes list may be empty for an EVPN peering even though the remote switch reports received routes. | 3.6.0-3.7.12 | |
| CM-21055 | On the Mellanox switch, the destination MAC address of ERSPAN GRE packets is set to all zeros; therefore, the first transit switch might drop packets. | 3.6.0-3.7.12 | |
| CM-20966 | The NCLU net show lldp and net show interface commands do not show LLDP information for swp* (eth is unaffected). | 3.6.0-3.7.8 | 3.7.9-3.7.12 |
| CM-20813 | Span rules matching the out-interface as a bond do not mirror packets. | 3.6.0-3.7.12 | |
| CM-20809 | The following CVEs were announced in a Debian Security Advisory. ————————————————————————————————– It was discovered that Ghostscript incorrectly handled certain PostScript files. An attacker could possibly use this to cause a denial of server. (CVE-2016-10317) It was discovered that Ghostscript incorrectly handled certain PDF files. An attacker could possibly use this to cause a denial of service. (CVE-2018-10194) Debian CVE links: https://security-tracker.debian.org/tracker/CVE-2016-10317 and https://security-tracker.debian.org/tracker/CVE-2018-10194 | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-20693 | In NCLU, you can only set the community number in a route map. You cannot set other community options such as no-export, no-advertise, or additive.This is a known limitation in network-docopt and is documented in the Cumulus Linux user guide. | 3.5.1-3.7.12 | |
| CM-20534 | The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.10 | 3.7.11-3.7.12 |
| CM-20508 | The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. | 3.5.3-3.7.12 | |
| CM-20480 | The python-crypto package, which is not installed by default on Cumulus Linux, but is present in the repository to be installed, has the following security vulnerability in the version available for Cumulus Linux 3.x: CVE-2018-6594: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto’s ElGamal implementation. More information at https://security-tracker.debian.org/tracker/CVE-2018-6594 . | 3.0.0-3.7.12 | |
| CM-20132 | On Trident2 switches running 802.3x regular link pause, pause frames are accounted in HwIfInDiscards counters and are dropped instead of processed. | 3.5.2-3.7.10 | 3.7.11-3.7.12 |
| CM-20033 | The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down. | 3.5.2-3.7.12 | |
| CM-19960 | The following CVEs were announced in Debian Security Advisory DSA-4131. ——————————————————————————————- Debian Security Advisory DSA-4131-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff March 04, 2018 https://www.debian.org/security/faq —————————————————————————————— Package: xen CVE ID: CVE-2018-7540 CVE-2018-7541 CVE-2018-7542 Multiple vulnerabilities have been discovered in the Xen hypervisor: CVE-2018-7540 Jann Horn discovered that missing checks in page table freeing may result in denial of service. CVE-2018-7541 Jan Beulich discovered that incorrect error handling in grant table checks may result in guest-to-host denial of service and potentially privilege escalation. CVE-2018-7542 Ian Jackson discovered that insufficient handling of x86 PVH guests without local APICs may result in guest-to-host denial of service. For the stable distribution (stretch), these problems have been fixed in version 4.8.3+comet2+shim4.10.0+comet3-1+deb9u5. We recommend that you upgrade your xen packages. For the detailed security status of xen please refer to its security tracker page at: https://security-tracker.debian.org/tracker/xen | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-19788 | If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict.To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. | 3.5.0-3.7.12 | |
| CM-19724 | PIM and MSDP entries are set to the internal COS value of 6 so they are grouped together with the bulk traffic priority group in the default traffic.conf file. However, PIM, IGMP, and MSDP are considered control-plane and should be set to the internal COS value of 7. | 3.5.2-3.7.12 | |
| CM-19454 | When you use NCLU to bring a bond admin down (net add bond <bond> link down), the bond interface goes into admin down state but the switch ports enslaved to the bond remain UP. If you are using bond-lacp-bypass-allow or balance-xor mode, the host might continue to send traffic. This traffic will be dropped because although the bond slaves are UP, they are not members of the bridge.To work around this issue, use the sudo ifdown <bondname> command. | 3.5.0-3.7.12 | |
| CM-18727 | On the Mellanox SN-2100 switch, unicast packets are counted in multicast queue counters. | 3.4.3-3.7.10 | 3.7.11-3.7.12 |
| CM-18537 | Drops due to congestion do not appear to be counted on a Mellanox switch. To work around this issue, run the sudo ethtool -S swp1 command to collect interface traffic statistics. | 3.4.2-3.7.8 | 3.7.9-3.7.12 |
| CM-17934 | FRR tracks interface speed based on the value it learns from the Linux kernel for that interface. If the interface speed changes, FRR does not update its interface speed cache. This can lead to issues for routing protocols that derive metrics from interface speed as the cost can become out of sync with the interface speed. To work around this issue, manually define the routing protocol metric for these interfaces or restart FRR. | 3.7.6-3.7.12 | |
| CM-17557 | When sFlow is enabled, some sampled packets, such as IPMC, are forwarded twice (in the ASIC and then again through the kernel networking stack). | 3.4.0-3.7.12 | |
| CM-17494 | In certain cases, a peer device sends an ARP request from a source IP address that is not on the connected subnet and the switch creates a STALE neighbor entry. Eventually, the switch attempts to keep the entry fresh and sends ARP requests to the host. If the host responds, the switch has REACHABLE neighbor entries for hosts that are not on the connected subnet. To work around this issue, change the value of arp_ignore to 2. See Default ARP Settings in Cumulus Linux for more information. | 3.3.2-3.7.12 | |
| CM-16855 | If a two nodes on both sides of a link change from auto-negotiation off to auto-negotiation on for both sides during a short interval (around one second), the link might start flapping or stay down.To work around this issue and stop the flapping, turn the link down on the switch with the command ifdown swpX, wait a few seconds, then bring the link back up with the command ifup swpX. Repeat this on the other side if necessary. | 3.3.2-3.7.12 | |
| CM-16571 | NCLU cannot manage rsyslog to addresses routed via a VRF. In Cumulus Linux 4.0.0 and later, management VRF is enabled by default. To work around this issue, update the /etc/network/interfaces file to disable management VRF. | 3.4.3-3.7.12 | |
| CM-16461 | After booting a Cumulus VX virtual machine running the VMware OVA image, sometimes messages from sensors appear, indicating that the “Avg state” is critical, with all values displayed as 100.0. A cl-support is generated. | 3.4.2-3.7.12 | |
| CM-15812 | Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. | 3.2.1-3.7.12 | |
| CM-15601 | On a Mellanox switch in an MLAG environment, a packet from a dually connected host might ingress on one switch but the MAC DA is destined to the router on the peer switch. The packet will traverse the peer link but is not excluded from port isolation (or egress mask) filtering. Similarly, an IP multicast packet might traverse the peer link and need to be routed. | 3.6.2-3.7.12 | |
| CM-15278 | During a link flap test, you might occasionally see a message similar to: warning: swp6: netlink: cannot set link swp6 down: <span class="error">[Errno 98]</span> Address already in use. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-15094 | Counter samples for an 80G bond (2 x 40G) exported from the switch show an interface speed (ifSpeed) of 14.464Gbps. | 3.2.0-3.7.12 | |
| CM-13316 | When you try to remove a VNI from a bridge using a regex match, the VNI is added back when you run the ifreload -a command. | 3.1.1-3.7.10 | 3.7.11-3.7.12 |
Fixed issues in 3.7.8
| Issue ID | Description | Affects |
|---|---|---|
| CM-25801 | When you run the hostnamectl status command or start the systemd-hostnamed process, you see constant unregister_netdevice kernel messages in syslog and on the console. This causes syslog to become filled with these messages and makes troubleshooting difficult. | 3.7.7 |
3.7.7 Release Notes
Open issues in 3.7.7
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-29740 | The exim4 package available for optional installation on Cumulus Linux 3.x has the following vulnerability:DLA-2213-1 / CVE-2020-12783: Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. The spa authentication driver is not enabled by default. Vulnerable: <= 4.84.2-2+deb8u6 Fixed: 4.84.2-2+deb8u7 | 3.0.0-3.7.12 | |
| CM-29556 | CVE-2020-11868: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp. This affects: ntp-4.2.8p12 (possibly earlier) and ntp-4.2.8p13 The fix for https://bugs.ntp.org/3445 introduced a bug whereby a system that is running ntp-4.2.8p12 or p13 that only has one unauthenticated time source can be attacked in a way that causes the victim’s next poll to its source to be delayed, for as long as the attack is maintained. http://support.ntp.org/bin/view/Main/NtpBug3592 gives the following mitigations if it is not possible to upgrade to a version with the fix:
| 3.0.0-3.7.12 | |
| CM-29518 | The following vulnerability affects the ruby2.1 package, which is installed by default: CVE-2020-10663: The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.1 has an unsafe object creation vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. Vulnerable: 2.1.5-2+deb8u9 Fixed: 2.1.5-2+deb8u10 | 3.0.0-3.7.12 | |
| CM-29484 | The following vulnerability affects libgd2/libgd3: CVE-2018-14553: gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled). Vulnerable: <= 2.1.0-5+deb8u13 Fixed: 2.1.0-5+deb8u14 | 3.0.0-3.7.12 | |
| CM-29483 | The following vulnerability affects imptool: CVE-2020-5208: It’s been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. Vulnerable: <= 1.8.14-4 Fixed: 1.8.14-4+deb8u1 | 3.0.0-3.7.12 | |
| CM-29284 | The following vulnerabilities affect git, which is available in the repository for optional installation: CVE-2020-5260: Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. CVE-2020-11008: Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. | 3.0.0-3.7.12 | |
| CM-29208 | The following vulnerability has been announced in ceph; the associated libraries librados2 and librbd1 are available in the Cumulus Linux 3 repository for optional installation. CVE-2020-1760: It was discovered that there was a header-splitting vulnerability in ceph, a distributed storage and file system. Vulnerable: <= 0.80.7-2+deb8u2 Fixed: 0.80.7-2+deb8u4 | 3.0.0-3.7.12 | |
| CM-29048 | The following vulnerability exists in the ruby2.1 package: CVE-2016-2338: An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer “head” allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow Vulnerable: <= 2.1.5-2+deb8u8 Fixed: 2.1.5-2+deb8u9 | 3.0.0-3.7.12 | |
| CM-29040 | The following issue has been found in e2fsprogs, a package that contains ext2/ext3/ext4 file system utilities:CVE-2019-5188: A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. | 3.0.0-3.7.12 | |
| CM-28993 | The following security vulnerability has been announced that affects the libicu52 package: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. Vulnerable: <= 52.1-8+deb8u7 Fixed: 52.1-8+deb8u8 | 3.0.0-3.7.12 | |
| CM-28992 | The following security vulnerability has been announced: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. | 3.0.0-3.7.12 | |
| CM-28954 | The python-twisted-* packages, which are available for optional installation in Cumulus Linux but are not installed by default, were found to have the following security vulnerabilities: CVE-2020-10808: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request. CVE-2020-10809: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request. | 3.0.0-3.7.12 | |
| CM-28944 | A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted. To work around this issue, reenter the redistribute <connected\|static> route-map <route-map-name> statement in the configuration. | 3.6.2-3.7.12 | |
| CM-28938 | When you install an ACL LOG/DROP rule on a layer 3 ingress interface that is a member of a VRF, traffic that matches this rule is not logged and is still forwarded. To work around this issue, apply the ACL LOG/DROP rule to the VRF device itself or to the layer 2 VNI. | 3.7.6-3.7.12 | |
| CM-28867 | The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12 | |
| CM-28816 | The following security advisory has been announced for bash: CVE-2019-18276 Qualys scan QID 372268 setuid vulnerability When bash or bash scripts are run setuid, bash is supposed to drop privileges, but does so incorrectly, so that an attacker with command access to the shell can use enable -f for runtime loading of a new builtin that calls setuid() to regain dropped privileges.To work around this issue, do not make bash or bash scripts setuid. | 3.0.0-3.7.12 | |
| CM-28811 | The following security vulnerability affects the libvpx1 library:CVE-2020-0034: It was discovered that there was an out-of-bounds buffer read vulnerability in libvpx, a library implementing the VP8 & VP9 videocodecs. | 3.0.0-3.7.12 | |
| CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.12 | |
| CM-28655 | When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.6.1-3.7.12 | |
| CM-28488 | The following CVEs were announced that affect the cron package. All of these require untrusted local user access.CVE-2017-9525 is a local user privilege escalation attack: In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs. CVE-2019-9704, CVE-2019-9705, CVE-2019-9706 are local user denial of service attacks. Note: the fix for CVE-2019-9705 imposes a limitation on the length of a crontab file (the vulnerability was that an unlimited size crontab file could cause excessive memory consumption). https://security-tracker.debian.org/tracker/DLA-1723-1 | 3.0.0-3.7.12 | |
| CM-28487 | The following CVE was announced for rsyslog: CVE-2019-17041 CVE-2019-17042 rsyslogd, when receiving remote log messages and using optional pmaixforwardedfrom or pmcisconames parser modules (not enabled by default on Cumulus Linux), is vulnerable to CVE-2019-17041 and CVE-2019-17042 where malicious messages that appear to be from AIX or Cisco respectively may be caused to skip sanity checks, resulting in incorrect negative lengths causing heap overflows.Do not enable (with $UDPServerRun or $InputTCPServerRun) receiving syslog messages from other hosts by the network. Also, do not enable (with $ModLoad) the vulnerable parsers pmaixforwardedfrom or pmcisconames.<br/>The default /etc/rsyslog.conf file on Cumulus Linux does NOT enable $UDPServerRun or $InputTCPServerRun, so the vulnerability is not network exploitable in the default configuration. In addition, the vulnerable parsers are not enabled in the default configuration. | 3.0.0-3.7.12 | |
| CM-28486 | The following vulnerability has been found in the libgcrypt20 cryptographic library. CVE-2019-13627: there was a ECDSA timing attack. For more information, see https://www.debian.org/lts/security/2020/dla-1931-2.en.html Vulnerable: 1.6.3-2+deb8u7 Fixed: 1.6.3-2+deb8u8 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28485 | The following vulnerability affects libxml2: CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c has a memory leak related to newDoc->oldNs. This can lead to a denial of service. For more information, see https://www.debian.org/lts/security/2019/dla-2048.en.html . Vulnerable: 2.9.1+dfsg1-5+deb8u7 Fixed: 2.9.1+dfsg1-5+deb8u8 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28484 | The following vulnerability affects libbsd, a package containing utility functions from BSD systems. CVE-2016-2090: In function fgetwln() an off-by-one error could triggers a heap buffer overflow. For more information, see https://www.debian.org/lts/security/2019/dla-2052.en.html . Vulnerable: 0.7.0-2 Fixed: 0.7.0-2+deb8u1 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28224 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2019-15890: libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. Vulnerable: <= 2.1+dfsg-12+deb8u11 Fixed: 2.1+dfsg-12+deb8u12 | 3.0.0-3.7.10 | 3.7.11-3.7.12 |
| CM-28223 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-1711: block: iscsi: OOB heap access via an unexpected response of iSCSI Server | 3.0.0-3.7.12 | |
| CM-28222 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-7039: tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code. Vulnerable: <= 2.1+dfsg-12+deb8u12 Fixed: 2.1+dfsg-12+deb8u13 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28219 | The following vulnerability affects sudo, which is installed by default on Cumulus Linux. It is potentially exploitable on Cumulus Linux if pwfeedback (which is NOT enabled by default) is enabled in the /etc/sudoers file. CVE-2019-18634: In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c. For more information, refer to: https://security-tracker.debian.org/tracker/source-package/sudo https://security-tracker.debian.org/tracker/CVE-2019-18634 https://www.sudo.ws/alerts/pwfeedback.html Vulnerable: <= 1.8.10p3-1+deb8u6 Fixed: 1.8.10p3-1+deb8u7 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28091 | Two security issues were found in the Python interface to the apt package manager, which is installed by default on Cumulus Linux; package downloads from unsigned repositories were incorrectly rejected (CVE-2019-15796) and the hash validation relied on MD5 (CVE-2019-15795). For more information, refer to https://security-tracker.debian.org/tracker/source-package/python-apt Vulnerable: 0.9.3.12 Fixed: 0.9.3.13 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28076 | After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom --init command. | 3.6.0-3.7.12 | |
| CM-28016 | On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. | 3.7.7-3.7.11 | 3.7.12 |
| CM-28007 | When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 | 3.7.12 |
| CM-27947 | Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. | 3.7.0-3.7.11 | 3.7.12 |
| CM-27937 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 One of the listed vulnerabilities is still present in the latest upstream version 2.1+dfsg-12+deb8u12 (the others have been fixed): CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. https://security-tracker.debian.org/tracker/CVE-2017-15124 | 3.0.0-3.7.12 | |
| CM-27924 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.26.dfsg1-13+deb8u1 Fixed: 2.1.26.dfsg1-13+deb8u2 | 3.0.0-3.7.11 | 3.7.12 |
| CM-27855 | The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. | 3.7.0-3.7.11 | 3.7.12 |
| CM-27793 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.27+dfsg-1 Fixed: 2.1.27+dfsg-1+deb10u1 | 3.0.0-3.7.12 | |
| CM-27698 | SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.12 | |
| CM-27683 | The following CVEs were announced that affect the Linux kernel: CVE-2019-12378: An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-12381: An issue was discovered in ip_ra_control in net/ipv4/ip_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-15239: In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation. CVE-2019-19062: A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042. CVE-2019-19537: In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID-303911cfc5b9. This affects drivers/usb/core/file.c. CVE-2019-20054: In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e. | 3.0.0-3.7.11 | 3.7.12 |
| CM-27646 | Several vulnerabilities have been discovered in Git, a fast, scalable, distributed revision control system, which is available in the Cumulus Linux 3.x repositories for optional installation. CVE-2019-1348: export-marks is insecure, fix is to disable by default. CVE-2019-1349: .git / git~1 filename vulnerability on NTFS CVE-2019-1352: .git vulnerability with NTFS Alternate Streams Accesses CVE-2019-1353: NTFS filesystem protection should be on by default CVE-2019-1387: dubiously-nested submodule git directories should be disallowed CVE-2019-19604: submodule update repository code execution vulnerability Vulnerable: <= 2.1.4-2.1+deb8u7 Fixed: 2.1.4-2.1+deb8u8 | 3.0.0-3.7.12 | |
| CM-27628 | The following security vulnerabilities have been announced in the nss/libnss3 library, which is not installed by default but is available in the repository: CVE-2019-11745: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate CVE-2019-17007: nss: Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may crash with a NULL deref leading to DoS See https://security-tracker.debian.org/tracker/source-package/nss for more information. Vulnerable: <= 3.26-1+debu8u7 Fixed: 3.26-1+debu8u9 | 3.0.0-3.7.10 | 3.7.11-3.7.12 |
| CM-27351 | On rare occasions, after rebooting the MLAG secondary switch, one MLAG device might see the peer as down, which can cause traffic disruption to connected hosts. | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-27349 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 The latest upstream version 2.1+dfsg-12+deb8u12 fixes the following vulnerabilities listed in that announcement: CVE-2017-15038 Tuomas Tynkkynen discovered an information leak in 9pfs. CVE-2017-15119 Eric Blake discovered that the NBD server insufficiently restricts large option requests, resulting in denial of service. CVE-2017-15268 A memory leak in websockets support may result in denial of service. CVE-2017-15289 Guoxiang Niu discovered an OOB write in the emulated Cirrus graphics adaptor which could result in denial of service. CVE-2017-16845 Cyrille Chatras discovered an information leak in PS/2 mouse and keyboard emulation which could be exploited during instance migration. CVE-2017-17381 Dengzhan Heyuandong Bijunhua and Liweichao discovered that an implementation error in the virtio vring implementation could result in denial of service. CVE-2017-18043 Eric Blake discovered an integer overflow in an internally used macro which could result in denial of service. CVE-2018-5683 Jiang Xin and Lin ZheCheng discovered an OOB memory access in the emulated VGA adaptor which could result in denial of service. CVE-2018-7550 Cyrille Chatras discovered that an OOB memory write when using multiboot could result in the execution of arbitrary code. The following remains vulnerable in 2.1+dfsg-12+deb8u12: CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. Note: qemu is not installed by default, but is available in the repository for optional installation. | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-27295 | IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.[ip6tables] | 3.7.2-3.7.11 | 3.7.12 |
| CM-27279 | When ECMP routes have both VXLAN (symmetric routing) and non-VXLAN paths, the non-VXLAN path is incorrectly installed in the RIB and FIB to point across VXLAN. The non-VXLAN next-hop will be installed as an offload entry in the neighbor table (ip neigh show) with a mac address of 00:00:00:00:00:00. | 3.7.3-3.7.12 | |
| CM-27174 | The ospfd daemon might crash with the following kernel trace:2019-11-06T23:00:08.261749+09:00 cumulus ospfd[5339]: Assertion ‘node’ failed in file ospfd/ospf_packet.c, line 671, function ospf_write | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-27096 | On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10 | 3.7.11-3.7.12 |
| CM-27094 | On the Delta AG9032v1 switch, smonctl and sensors report inaccurate PSU current and power. | 3.5.0-3.7.12 | |
| CM-27025 | On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. | 3.7.2-3.7.10 | 3.7.11-3.7.12 |
| CM-26838 | You might experience a bgpd memory usage increase and significant update exchanges due to host moves between VTEPs. | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-26769 | Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26657 | When you install a large number of new rules with nonatomic mode enabled, there is a chance that you install more rules than the number of available slots in the slice, which results in the slice being completely wiped and reinstalled. This causes a large drop increase, including to cpu0, and might cause a major outage by dropping all BGP sessions. | 3.6.1-3.7.10 | 3.7.11-3.7.12 |
| CM-26525 | When an MLAG peerlink frequently alternates states between learning and blocking, an excessive number of TCP sessions might be created, which results in the following error display:OSError: [Errno 24] Too many open files | 3.6.2-3.7.10 | 3.7.11-3.7.12 |
| CM-26523 | Package: hostapd CVE ID: CVE-2019-13377 CVE-2019-16275 Two vulnerabilities were found in the WPA protocol implementation found in wpa_supplication (station) and hostapd (access point). CVE-2019-13377 A timing-based side-channel attack against WPA3’s Dragonfly handshake when using Brainpool curves could be used by an attacker to retrieve the password. CVE-2019-16275 Insufficient source address validation for some received Management frames in hostapd could lead to a denial of service for stations associated to an access point. An attacker in radio range of the access point could inject a specially constructed unauthenticated IEEE 802.11 frame to the access point to cause associated stations to be disconnected and require a reconnection to the network. Fixed version: 1:2.8.0-cl4u3 | 3.7.0-3.7.10 | 3.7.11-3.7.12 |
| CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.12 | |
| CM-26450 | Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.12 | |
| CM-26272 | On the Mellanox Spectrum switch, a route withdrawal might cause the associated next hop neighbor entry to be deleted in hardware but remain in the kernel. This can cause traffic going through the directly connected route to the removed neighbor entry to be forwarded to the CPU. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26255 | On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26252 | The following CVEs were announced that affect the ghostscript package: CVE ID : CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817 It was discovered that various procedures in Ghostscript, the GPL PostScript/PDF interpreter, do not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.7.0-3.7.10 | 3.7.11-3.7.12 |
| CM-26241 | On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. | 3.7.6-3.7.11 | 3.7.12 |
| CM-26217 | NCLU does not allow you to configure OSPF NSSAs. For example:cumulus@switch:~$ net add ospf area 0.0.0.1 nssa To work around this issue, use FRR instead. For example: switch# configure terminal | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-26181 | ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).-A FORWARD -i swp+ -j LOG You can now install such rules with swp+. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-26179 | If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error:ERROR: ‘ascii’ codec can’t encode character u’\xe9’ in position 3: ordinal not in range(128) | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-26147 | On the EdgeCore AS4610 switch, the ping command fails unless you run the command with sudo.To work around this issue, run the following commands: cumulus@switch:~$ sudo setcap cap_net_raw+ep /usr/share/mgmt-vrf/bin/ping Run the following command to verify the workaround:
You should see the following output:
| 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26139 | Selective ERSPAN does not work when you specify a bridge port. | 3.7.6-3.7.12 | |
| CM-26138 | You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:-A FORWARD -i swp5 -s 00:25:90:b2:bd:9d -d 50:6b:4b:96:c4:04 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64 | 3.7.6-3.7.12 | |
| CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:-A FORWARD -i vni10 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64 | 3.7.6-3.7.12 | |
| CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.12 | |
| CM-26126 | Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.12 | |
| CM-26073 | {watchfrr calls sudo /usr/sbin/service frr restart bgpd but restarts all FRR daemons which can cause a large outage. This occurs because watchfrr uses an old style service command, which causes all daemons to restart when a daemon fails. | 3.7.7-3.7.8 | 3.7.9-3.7.12 |
| CM-26024 | On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. | 3.7.7-3.7.12 | |
| CM-25979 | Dynamic route-leaking works as expected until FRR is restarted or the switch is rebooted. After the restart or reboot, the import RT under the VRF where routes are being imported is incorrect. | 3.7.7-3.7.8 | 3.7.9-3.7.12 |
| CM-25956 | The following CVEs were announced in Debian Security Advisory DSA-4499-1 and affect the ghostscript package. ————————————————————————————— Debian Security Advisory DSA-4499-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso August 12, 2019 https://www.debian.org/security/faq ————————————————————————————— Package: ghostscript CVE ID: CVE-2019-10216 Debian Bug: 934638 Netanel reported that the .buildfont1 procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. For the oldstable distribution (stretch), this problem has been fixed in version 9.26a~dfsg-0+deb9u4. For the stable distribution (buster), this problem has been fixed in version 9.27~dfsg-2+deb10u1. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-25955 | Lenovo switches do not send or receive LLDP on eth0 interfaces. | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-25944 | The following CVEs were announced in Debian Security Advisory DSA-4495 and DSA 4497 and affect the linux kernel package. ——————————————————————————————— Debian Security Advisory DSA-4495-1 security@debian.org https://www.debian.org/security/ Ben Hutchings August 10, 2019 https://www.debian.org/security/faq ——————————————————————————————— Package: linux CVE ID: CVE-2018-20836 CVE-2019-1125 CVE-2019-1999 CVE-2019-10207 CVE-2019-10638 CVE-2019-12817 CVE-2019-12984 CVE-2019-13233 CVE-2019-13631 CVE-2019-13648 CVE-2019-14283 CVE-2019-14284 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2015-8553 Jan Beulich discovered that CVE-2015-2150 was not completely addressed. If a PCI physical function is passed through to a Xen guest, the guest is able to access its memory and I/O regions before enabling decoding of those regions. This could result in a denial-of-service (unexpected NMI) on the host. The fix for this is incompatible with qemu versions before 2.5. (CVE ID not yet assigned) Denis Andzakovic reported a missing type check in the IPv4 multicast routing implementation. A user with the CAP_NET_ADMIN capability (in any user namespace) could use this for denial-of-service (memory corruption or crash) or possibly for privilege escalation. CVE-2018-5995 ADLab of VenusTech discovered that the kernel logged the virtual addresses assigned to per-CPU data, which could make it easier to exploit other vulnerabilities. CVE-2018-20836 chenxiang reported a race condition in libsas, the kernel subsystem supporting Serial Attached SCSI (SAS) devices, which could lead to a use-after-free. It is not clear how this might be exploited. CVE-2019-1125 It was discovered that most x86 processors could speculatively skip a conditional SWAPGS instruction used when entering the kernel from user mode, and/or could speculatively execute it when it should be skipped. This is a subtype of Spectre variant 1, which could allow local users to obtain sensitive information from the kernel or other processes. It has been mitigated by using memory barriers to limit speculative execution. Systems using an i386 kernel are not affected as the kernel does not use SWAPGS. CVE-2019-1999 A race condition was discovered in the Android binder driver, which could lead to a use-after-free. If this driver is loaded, a local user might be able to use this for denial-of-service (memory corruption) or for privilege escalation. CVE-2019-1125 It was discovered that most x86 processors could speculatively skip a conditional SWAPGS instruction used when entering the kernel from user mode, and/or could speculatively execute it when it should be skipped. This is a subtype of Spectre variant 1, which could allow local users to obtain sensitive information from the kernel or other processes. It has been mitigated by using memory barriers to limit speculative execution. Systems using an i386 kernel are not affected as the kernel does not use SWAPGS. CVE-2019-3882 It was found that the vfio implementation did not limit the number of DMA mappings to device memory. A local user granted ownership of a vfio device could use this to cause a denial of service (out-of-memory condition). CVE-2019-3900 It was discovered that vhost drivers did not properly control the amount of work done to service requests from guest VMs. A malicious guest could use this to cause a denial-of-service (unbounded CPU usage) on the host. CVE-2019-10207 The syzkaller tool found a potential null dereference in various drivers for UART-attached Bluetooth adapters. A local user with access to a pty device or other suitable tty device could use this for denial-of-service (BU G/oops). CVE-2019-10638 Amit Klein and Benny Pinkas discovered that the generation of IP packet IDs used a weak hash function, “jhash”. This could enable tracking individual computers as they communicate with different remote servers and from different networks. The “siphash” function is now used instead. CVE-2019-10639 Amit Klein and Benny Pinkas discovered that the generation of IP packet IDs used a weak hash function that incorporated a kernel virtual address. This hash function is no longer used for IP IDs, although it is still used for other purposes in the network stack. CVE-2019-12817 It was discovered that on the PowerPC (ppc64el) architecture, the hash page table (HPT) code did not correctly handle fork() in a process with memory mapped at addresses above 512 TiB. This could lead to a use-after-free in the kernel, or unintended sharing of memory between user processes. A local user could use this for privilege escalation. Systems using the radix MMU, or a custom kernel with a 4 KiB page size, are not affected. CVE-2019-12984 It was discovered that the NFC protocol implementation did not properly validate a netlink control message, potentially leading to a null pointer dereference. A local user on a system with an NFC interface could use this for denial-of-service (BUG/oops). CVE-2019-13233 Jann Horn discovered a race condition on the x86 architecture, in use of the LDT. This could lead to a use-after-free. A local user could possibly use this for denial-of-service. CVE-2019-13631 It was discovered that the gtco driver for USB input tablets could overrun a stack buffer with constant data while parsing the device’s descriptor. A physically present user with a specially constructed USB device could use this to cause a denial-of-service (BUG/oops), or possibly for privilege escalation. CVE-2019-13648 Praveen Pandey reported that on PowerPC (ppc64el) systems without Transactional Memory (TM), the kernel would still attempt to restore TM state passed to the sigreturn() system call. A local user could use this for denial-of-service (oops). CVE-2019-14283 The syzkaller tool found a missing bounds check in the floppy disk driver. A local user with access to a floppy disk device, with a disk present, could use this to read kernel memory beyond the I/O buffer, possibly obtaining sensitive information. CVE-2019-14284 The syzkaller tool found a potential division-by-zero in the floppy disk driver. A local user with access to a floppy disk device could use this for denial-of-service (oops). (CVE ID not yet assigned) Denis Andzakovic reported a possible use-after-free in the TCP sockets implementation. A local user could use this for denial-of-service (memory corruption or crash) or possibly for privilege escalation. (CVE ID not yet assigned) The netfilter conntrack subsystem used kernel addresses as user-visible IDs, which could make it easier to exploit other security vulnerabilities. XSA-300 Julien Grall reported that Linux does not limit the amount of memory which a domain will attempt to baloon out, nor limits the amount of “foreign / grant map” memory which any individual guest can consume, leading to denial of service conditions (for host or guests). For the oldstable distribution (stretch), these problems have been fixed in version 4.9.168-1+deb9u5. For the stable distribution (buster), these problems have been fixed in version 4.19.37-5+deb10u2. For the oldstable distribution (stretch), these problems will be fixed soon. We recommend that you upgrade your linux packages. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.12 | |
| CM-25859 | The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. | 3.7.7-3.7.12 | |
| CM-25824 | NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.12 | |
| CM-25801 | When you run the hostnamectl status command or start the systemd-hostnamed process, you see constant unregister_netdevice kernel messages in syslog and on the console. This causes syslog to become filled with these messages and makes troubleshooting difficult. | 3.7.7 | 3.7.8-3.7.12 |
| CM-25796 | Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:ifdown vlan123 ; sleep 2 ; ifup vlan123 You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. | 3.7.5-3.7.12 | |
| CM-25794 | Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.12 | |
| CM-25784 | The following CVEs were announced in Debian Security Advisory DSA-4489-1. ————————————————————————————— Debian Security Advisory DSA-4489-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso July 27, 2019 https://www.debian.org/security/faq ————————————————————————————— Package: patch CVE ID: CVE-2019-13636 CVE-2019-13638 Debian Bug: 932401 933140 Imre Rad discovered several vulnerabilities in GNU patch, leading to shell command injection or escape from the working directory and access and overwrite files, if specially crafted patch files are processed. This update includes a bugfix for a regression introduced by the patch to address CVE-2018-1000156 when applying an ed-style patch (#933140). For the oldstable distribution (stretch), these problems have been fixed in version 2.7.5-1+deb9u2. For the stable distribution (buster), these problems have been fixed in version 2.7.6-3+deb10u1. We recommend that you upgrade your patch packages. For the detailed security status of patch please refer to its security tracker page at: https://security-tracker.debian.org/tracker/patch | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-25783 | Cumulus Linux installer images have a shell script that validates checksum integrity. When you run onie-install, this check is run but the installer is still staged even if the checksum validation fails.To work around this issue, perform your own checksum validation before staging a new image with onie-install. | 3.7.7-3.7.8 | 3.7.9-3.7.12 |
| CM-25770 | On a Tomahawk switch, the 5m 40G DACs (40G CR4) do not come up when both sides have auto-negotiation enabled. | 3.7.7-3.7.8 | 3.7.9-3.7.12 |
| CM-25766 | On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. | 3.7.7-3.7.12 | |
| CM-25754 | A port that is used as both a double tag interface and a VXLAN access side interface does not forward correctly; VXLAN decapsulation is does not occur. However, do not configure double tagged interfaces on VXLAN uplink ports as this will cause VXLAN routing issues. | 3.6.2-3.7.8 | 3.7.9-3.7.12 |
| CM-25747 | When transitioning from a down state to an up state due to peerlink failure and recovery, MLAG does not start the initDelay timer before trying to bring everything back up. | 3.7.7-3.7.10 | 3.7.11-3.7.12 |
| CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:cumulus@switch:~$ net add bridge mybridge vlan-protocol 802.1ad | 3.7.6-3.7.12 | |
| CM-25718 | IF-MIB::ifHCInOctets reports significantly lower values than reported by interface counters seen elsewhere. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25694 | If a packet is policed by ebtables, it does not increment an ACL drop on the ingress interface. Instead, it increments the TDBGC3/6 drop counter to the CPU. | 3.7.6-3.7.12 | |
| CM-25693 | After you issue the NCLU net del bgp vrf <vrf> autonomous-system <AS> command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-25684 | For interfaces configured with RS FEC, when switchd is restarted, the link goes down but does not automatically come back up. This occurs because the FEC status is not replayed correctly into the kernel.To work around this issue, run the ifreload -a command to bring up the interface after switchd is restarted. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25674 | On Mellanox switches, policer iptables are not working as expected. For example, when using a policer with mode KB/MB/GB to rate-limit interfaces, the syntax is accepted but the data plane transfer speed is not affected by the rule. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25672 | snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. | 3.7.4-3.7.10 | 3.7.11-3.7.12 |
| CM-25665 | On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur:
| 3.7.5-3.7.11 | 3.7.12 |
| CM-25664 | On the Trident3 platform, you can only add 50 percent of the total ECMP next hops. A log message indicates that the table is full. | 3.7.7-3.7.8 | 3.7.9-3.7.12 |
| CM-25646 | When moving an IP address from the address line to inet dhcp, then issuing the ifreload -a command, the old address is not removed from the interface. NCLU still reports the old address only and reports it as a DHCP address. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25641 | If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl.To work around this issue, power cycle the switch. | 3.7.6-3.7.12 | |
| CM-25640 | When you configure the switch to send an EAP request with the net add dot1x send-eap-request-id command, the switch ignores re-authentication attempts and does not send back an EAPol. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25619 | After configuring switchd hal.bcm.per_vlan_router_mac_lookup to TRUE on a Broadcom switch, layer 2 traffic works over VXLAN but the host is not able to ping the locally connected gateway and loses routing ability to other IPs and subnets. | 3.6.0-3.7.8 | 3.7.9-3.7.12 |
| CM-25610 | BGP update packets are sometimes missing the mandatory nexthop attribute, which causes connections to reset. For example, this issue is seen when using VRF route leaking with a mix of BGP unnumbered and BGP numbered peers. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25505 | In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result. In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example:
| 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25489 | When BGP remove-private-AS replace-AS is configured under the BGP IPv4 or IPv6 address family between a pair of switches configured as BGP peers, a BGP route update might cause the BGP session to flap.To work around this issue, do not configure remove-private-AS replace-AS in the BGP IPv4 or IPv6 address family. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25467 | The following CVEs were announced in Debian Security Advisory DSA-4472-1 and affect the expat (libexpat1) package. ————————————————————————————- Debian Security Advisory DSA-4472-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso June 28, 2019 https://www.debian.org/security/faq ————————————————————————————- Package: expat CVE ID: CVE-2018-20843 Debian Bug: 931031 It was discovered that Expat, an XML parsing C library, did not properly handled XML input including XML names that contain a large number of colons, potentially resulting in denial of service. For the stable distribution (stretch), this problem has been fixed in version 2.2.0-2+deb9u2. We recommend that you upgrade your expat packages. For the detailed security status of expat, refer to its security tracker page at: https://security-tracker.debian.org/tracker/expat | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-25447 | When you define a trap destination using @mgmt, snmpd indicates that the network is unreachable even though the IP address is reachable in the management VRF.To work around this issue, remove @mgmt vrf references in the /etc/snmp/snmpd.conf file, stop snmpd, then start snmpd manually in the management VRF with the systemctl start snmpd@mgmt command. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25432 | The snmpd service frequently crashes due to double free or corruption. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25417 | The IP neighbor entry for a link-local next hop (169.254.x.x) is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which can be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. | 3.7.7-3.7.8 | 3.7.9-3.7.12 |
| CM-25414 | On the Mellanox SN2410 switch, switchd does not start. | 3.7.2-3.7.8 | 3.7.9-3.7.12 |
| CM-25404 | hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. | 3.7.6-3.7.12 | |
| CM-25400 | If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. | 3.7.6-3.7.12 | |
| CM-25397 | When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. | 3.7.3-3.7.12 | |
| CM-25395 | When you run the NCLU net del all command, the exec-timeout setting changes in the /etc/frr.frr.conf file. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25376 | When you generate a cl-support file, clagd.service prints log messages similar to the following:019-03-21T07:18:15.727581+00:00 leaf01 clagd[20912]: DumpThreadStacks - start 2019-03-21T07:18:15.728157+00:00 leaf01 clagd[20912]: #012thread: CollectSysInfo (140608446367488) 2019-03-21T07:18:15.735986+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 783, in __bootstrap 2019-03-21T07:18:15.736585+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 810, in __bootstrap_inner 2019-03-21T07:18:15.737045+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 763, in run 2019-03-21T07:18:15.737933+00:00 leaf01 clagd[20912]: file: /usr/sbin/clagd, line 930, in CollectSysInfoT 2019-03-21T07:18:15.739527+00:00 leaf01 clagd[20912]: file: /usr/sbin/clagd, line 187, in CollectSysInfo 2019-03-21T07:18:15.740540+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 621, in wait 2019-03-21T07:18:15.742293+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/dist-packages/clag/clagthread.py, line 48, in wait . . 2019-03-21T07:18:16.456061+00:00 leaf01 clagd[20912]: DumpThreadStacks - end | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25358 | When you configure the link-down yes attribute to a physical SVI, the VRR (-v0) interface is not brought down, and the locally-connected subnet can still be redistributed into routing protocols and advertised to neighbors despite the physical SVI being administratively down.To work around this issue, manually bring down the VRR (-v0) interface with the ip link set dev command. For example:cumulus@switch:~$ sudo ip link set dev vlan1755-v0 down | 3.6.1-3.7.8 | 3.7.9-3.7.12 |
| CM-25343 | The following CVEs were announced in Debian Security Advisory DSA-4465-1 and affect the linux kernel. ——————————————————————————————- Debian Security Advisory DSA-4465-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso June 17, 2019 https://www.debian.org/security/faq ——————————————————————————————- Package: linux CVE ID: CVE-2019-3846 CVE-2019-5489 CVE-2019-9500 CVE-2019-9503 CVE-2019-10126 CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 CVE-2019-11486 CVE-2019-11599 CVE-2019-11815 CVE-2019-11833 CVE-2019-11884 Debian Bug: 928989 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2019-3846, CVE-2019-10126 huangwen reported multiple buffer overflows in the Marvell wifi (mwifiex) driver, which a local user could use to cause denial of service or the execution of arbitrary code. CVE-2019-5489 Daniel Gruss, Erik Kraft, Trishita Tiwari, Michael Schwarz, Ari Trachtenberg, Jason Hennessey, Alex Ionescu, and Anders Fogh discovered that local users could use the mincore() system call to obtain sensitive information from other processes that access the same memory-mapped file. CVE-2019-9500, CVE-2019-9503 Hugues Anguelkov discovered a buffer overflow and missing access validation in the Broadcom FullMAC wifi driver (brcmfmac), which a attacker on the same wifi network could use to cause denial of service or the execution of arbitrary code. CVE-2019-11477 Jonathan Looney reported that a specially crafted sequence of TCP selective acknowledgements (SACKs) allows a remotely triggerable kernel panic. CVE-2019-11478 Jonathan Looney reported that a specially crafted sequence of TCP selective acknowledgements (SACKs) will fragment the TCP retransmission queue, allowing an attacker to cause excessive resource usage. CVE-2019-11479 Jonathan Looney reported that an attacker could force the Linux kernel to segment its responses into multiple TCP segments, each of which contains only 8 bytes of data, drastically increasing the bandwidth required to deliver the same amount of data. This update introduces a new sysctl value to control the minimal MSS (net.ipv4.tcp_min_snd_mss), which by default uses the formerly hard-coded value of 48. We recommend raising this to 536 unless you know that your network requires a lower value. CVE-2019-11486 Jann Horn of Google reported numerous race conditions in the Siemens R3964 line discipline. A local user could use these to cause unspecified security impact. This module has therefore been disabled. CVE-2019-11599 Jann Horn of Google reported a race condition in the core dump implementation which could lead to a use-after-free. A local user could use this to read sensitive information, to cause a denial of service (memory corruption), or for privilege escalation. CVE-2019-11815 It was discovered that a use-after-free in the Reliable Datagram Sockets protocol could result in denial of service and potentially privilege escalation. This protocol module (rds) is not auto-loaded on Debian systems, so this issue only affects systems where it is explicitly loaded. CVE-2019-11833 It was discovered that the ext4 filesystem implementation writes uninitialised data from kernel memory to new extent blocks. A local user able to write to an ext4 filesystem and then read the filesystem image, for example using a removable drive, might be able to use this to obtain sensitive information. CVE-2019-11884 It was discovered that the Bluetooth HIDP implementation did not ensure that new connection names were null-terminated. A local user with CAP_NET_ADMIN capability might be able to use this to obtain sensitive information from the kernel stack. For the stable distribution (stretch), these problems have been fixed in version 4.9.168-1+deb9u3. We recommend that you upgrade your linux packages. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25298 | The following CVEs were announced in a Debian Security Advisory that affects vim modelines. Package: vim and neovim CVE ID: CVE-2019-12735 Debian Bugs: 930020, 930024 getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim. For the detailed security status, refer to the security tracker page at: https://security-tracker.debian.org/tracker/CVE-2019-12735 https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12735.html https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md Cumulus Networks recommends that you disable modelines in the the vimrc file (set nomodeline) to use the securemodelines plugin or to disable modelineexpr (since patch 8.1.1366, Vim-only) to disallow expressions in modelines.To check if you have modelines enabled, open vim and enter: :set modeline? If vim returns nomodeline, you are not vulnerable. If you are vulnerable or you want to ensure your security with this issue, add these lines to your vimrc file:set modelines=0 set nomodeline modeline is enabled by default. Verify that you do not have any existing lines in .vimrc that set modelines or modeline. | 3.0.0-3.7.10 | 3.7.11-3.7.12 |
| CM-25295 | The ifquery command should return a non-zero value if there is a syntax error. However, it currently returns zero. This issue affects automation scripts that validate a file before copying it into place. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25284 | If you configure a sys-mac with a single digit, ifreload -a does not indicate that the MAC address is invalid for the MLAG sys-mac and the clagd process fails silently. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25240 | If the address-virtual MAC address is missing a leading zero in the last octet, the interface bounces. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25079 | The snmpd service exits with a message similar to the following:Error in ‘/usr/sbin/snmpd’: double free or corruption (fasttop): 0x00000000018a4e50 *** This problem might occur during or after network convergence events. For example, when bgpd needs to process a high number of updates and the CPU cannot keep up, bgpd is disconnected and agentx generates a core dump in snmpd due to a memory allocation problem.To work around this issue, disable agentx by commenting out the following lines in the /etc/snmp/snmpd.conf file. Then, restart the snmpd service with the systemctl restart snmpd command.agentxperms 777 777 snmp snmp agentxsocket /var/agentx/master If you still want to poll the BGP4-MIB information, re-enable the bgp pass persist script by adding the following line in the /etc/snmp/snmpd.conf file:pass_persist 1.3.6.1.2.1.15 /usr/share/snmp/bgp4_pp.py | 3.7.2-3.7.8 | 3.7.9-3.7.12 |
| CM-25001 | The following CVEs were announced in Debian Security Advisory DSA-444-1, DSA-4447-1 and affect the linux kernel and microcode. Package: linux CVE ID: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 Multiple researchers have discovered vulnerabilities in the way the Intel processor designs have implemented speculative forwarding of data filled into temporary microarchitectural structures (buffers). This flaw could allow an attacker controlling an unprivileged process to read sensitive information, including from the kernel and all other processes running on the system or cross guest/host boundaries to read host memory. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details. To fully resolve these vulnerabilities it is also necessary to install updated CPU microcode. Contact your hardware ndor for microcode uppdates. In addition, this update includes a fix for a regression causing deadlocks inside the loopback driver. Fixed in version 4.19.76-1+cl4u1 | 3.0.0-3.7.12 | |
| CM-24963 | The following CVEs were announced in Debian Security Advisory DSA-4440-1. ————————————————————————————— Debian Security Advisory DSA-4440-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff May 09, 2019 https://www.debian.org/security/faq ————————————————————————————— Package: bind9 CVE ID: CVE-2018-5743 CVE-2018-5745 CVE-2019-6465 Multiple vulnerabilities were found in the BIND DNS server: CVE-2018-5743 Connection limits were incorrectly enforced. CVE-2018-5745 The “managed-keys” feature was susceptible to denial of service by triggering an assert. CVE-2019-6465 ACLs for zone transfers were incorrectly enforced for dynamically loadable zones (DLZs). For the stable distribution (stretch), these problems have been fixed in version 1:9.10.3.dfsg.P4-12.3+deb9u5. We recommend that you upgrade your bind9 packages. For the detailed security status of bind9 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/bind9 | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-24894 | The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. | 3.7.5-3.7.12 | |
| CM-24803 | On the Dell N3048EP-ON or the Delta AG6248 switch, when you execute the following command, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The Cumulus Linux image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new Cumulus Linux image.The workaround only works when an out-of-band network is present. | 3.7.6-3.7.12 | |
| CM-24799 | On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. | 3.7.5-3.7.12 | |
| CM-24784 | NCLU is unable to delete a BGP neighbor configuration if there is a VRF VNI mapping in the /etc/frr/frr.conf file. For example, the following NCLU command produces an error:cumulus@leaf01$ net del bgp neighbor swp5 interface peer-group spine ‘router bgp 65001’ configuration does not have ‘neighbor swp5 interface peer-group spine’ | 3.7.7-3.7.8 | 3.7.9-3.7.12 |
| CM-24751 | On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. | 3.7.3-3.7.12 | |
| CM-24703 | The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.12 | |
| CM-24686 | On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. | 3.7.3-3.7.12 | |
| CM-24652 | In an EVPN environment, the centralized MAC address is not installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN. This issue does not affect a pure distributed routing (symmetric or asymmetric) environment or a pure centralized routing environment. | 3.7.0-3.7.12 | |
| CM-24618 | If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:ERROR: No closing quotation See /var/log/netd.log for more details. | 3.6.1-3.7.12 | |
| CM-24593 | On a Dell S5248F (Trident3) switch, packets from switch ports are forwarded to the CPU and are sometimes corrupted. The corruption might result in BGP peerings being down, which can lead to all VXLAN traffic to and from a node to be lost, causing an outage to dually connected hosts in a rack. To work around this issue, restart switchd. | 3.7.3-3.7.8 | 3.7.9-3.7.12 |
| CM-24544 | If the clagd-vxlan-anycast-ip is removed from the /etc/network/interfaces file (either with the NCLU command or by editing the file manually), MLAG still believes it is present until clagd restarts. | 3.7.3-3.7.8 | 3.7.9-3.7.12 |
| CM-24473 | SNMP incorrectly requires engine ID specification. | 3.7.4-3.7.12 | |
| CM-24440 | bgpd creates a core dump at zclient_send_interface_radv_req. This is an issue with how FRRouting checks next hops and has been pushed upstream to FRRouting. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-24435 | When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect: net add routing route-map Proxy-ARP permit 25 match interface swp9-10 These commands are correct: net add routing route-map Proxy-ARP permit 25 match interface swp9 net add routing route-map Proxy-ARP permit 30 match interface swp10 | 3.7.2-3.7.12 | |
| CM-24426 | NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf <name> command just displays
Tab completion for the net add vrf <name> ip address <address> command works correctly. | 3.7.4-3.7.12 | |
| CM-24379 | On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.12 | |
| CM-24343 | The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. | 3.7.4-3.7.12 | |
| CM-24332 | On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. | 3.7.3-3.7.12 | |
| CM-24272 | When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface br0.100 switch(config-if)# vrrp 1 priority 110 switch(config-if)# vrrp 1 advertisement-interval switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24271 | On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface vlan100 switch(config-if)# vrrp 1 priority 110 switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24270 | Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example: cumulus@switch:~$ sudo vtysh switch# configure terminal switch(config)# interface swp4 switch(config-if)# vrrp 1 version 2 switch(config-if)# no vrrp 1 preempt switch(config-if)# end switch# write memory switch# exit cumulus@switch:~ | 3.7.4-3.7.12 | |
| CM-24262 | NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto <iface> lines exist. | 3.7.3-3.7.12 | |
| CM-24241 | When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:cumulus@switch:~$ net del bgp neighbor fabric peer-group ‘router bgp 65001’ configuration does not have ‘neighbor fabric peer-group’ | 3.7.2-3.7.12 | |
| CM-24222 | When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. | 3.7.0-3.7.12 | |
| CM-24035 | On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. | 3.7.2-3.7.12 | |
| CM-23825 | The net add interface <interface> ptm-enable command adds no ptm-enable for that interface in the frr.conf file.Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. | 3.7.2-3.7.12 | |
| CM-23792 | When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table.To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev <interface> command. | 3.7.0-3.7.12 | |
| CM-23696 | IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. | 3.7.2-3.7.12 | |
| CM-23665 | NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan <layer3-vni> bridge access <vlan>. This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.To restore connectivity, remove the VLAN ID from the bridge. | 3.7.2-3.7.12 | |
| CM-23661 | On the Mellanox switch, when you configure a GRE tunnel, the traffic behind the local tunnel endpoint destined through the GRE tunnel is software-forwarded. | 3.7.2-3.7.12 | |
| CM-23652 | The NCLU command net show bridge spanning-tree does not show the MLAG peer link as part of the STP forwarding instance.To work around this issue, use the mstpctl command to confirm the STP status of the port. | 3.7.2-3.7.8 | 3.7.9-3.7.12 |
| CM-23651 | In an EVPN symmetric routing configuration, when an IP address is frozen, kernel neighbor table information and kernel VRF routing table information about the frozen IP address might be out-of-sync. | 3.7.3-3.7.12 | |
| CM-23636 | The following CVEs were announced in Debian Security Advisory DSA-4436-1 and affect the imagemagick packages. ——————————————————————————————- Debian Security Advisory DSA-4371-1 security@debian.org https://www.debian.org/security/ Yves-Alexis Perez January 22, 2019 https://www.debian.org/security/faq ——————————————————————————————- Max Justicz discovered a vulnerability in APT, the high level package manager. The code handling HTTP redirects in the HTTP transport method doesn’t properly sanitize fields transmitted over the wire. This vulnerability could be used by an attacker located as a man-in-the-middle between APT and a mirror to inject malicous content in the HTTP connection. This content could then be recognized as a valid package by APT and used later for code execution with root privileges on the target machine. Since the vulnerability is present in the package manager itself, it is recommended to disable redirects in order to prevent exploitation during this upgrade only, using: apt -o Acquire::http::AllowRedirect=false update apt -o Acquire::http::AllowRedirect=false upgrade The code handling HTTP redirects in the HTTP transport method doesn’t properly sanitize fields transmitted over the wire. This vulnerability could be used by an attacker located as a man-in-the-middle between APT and a mirror to inject malicous content in the HTTP connection. This content could then be recognized as a valid package by APT and used later for code execution with root privileges on the target machine. Since the vulnerability is present in the package manager itself, it is recommended to disable redirects in order to prevent exploitation during this upgrade only, using: apt -o Acquire::http::AllowRedirect=false update apt -o Acquire::http::AllowRedirect=false upgrade This is known to break some proxies when used against security.debian.org. If that happens, people can switch their security APT source to use deb http://cdn-fastly.deb.debian.org/debian-security stable/updates main For the stable distribution (stretch), this problem has been fixed in version 1.4.9. | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-23584 | When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. | 3.7.2-3.7.12 | |
| CM-23570 | On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. | 3.7.2-3.7.12 | |
| CM-23523 | Modifying the /etc/netd.conf file to set show_linux_command = True does not take effect. | 3.7.2-3.7.8 | 3.7.9-3.7.12 |
| CM-23431 | On the Trident3 switch, the input chain ACLs drop action forwards packets if the traffic is destined to the CPU on an SVI. | 3.6.2-3.7.8 | 3.7.9-3.7.12 |
| CM-23422 | portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. | 3.7.0-3.7.12 | |
| CM-23418 | For QSFP modules, the sudo ifdown command does not disable the Tx laser. | 3.7.2-3.7.12 | |
| CM-23417 | If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. | 3.7.0-3.7.12 | |
| CM-23398 | The following CVEs were announced in Debian Security Advisory DSA-4359-1 and affect the wireshark packages, some of which are available for optional installation on Cumulus Linux: CVE ID: CVE-2018-12086 CVE-2018-18225 CVE-2018-18226 CVE-2018-18227 CVE-2018-19622 CVE-2018-19623 CVE-2018-19624 CVE-2018-19625 CVE-2018-19626 CVE-2018-19627 CVE-2018-19628 All CVEs except for CVE-2018-12086 are fixed in Cumulus Linux 3.7.9. Packages: libwireshark5, libwireshark-data, libwiretap8, libwscodecs2, libwsutil9, tshark, wireshark, wireshark-common, wireshark-doc These problems have been fixed in version 1.12.1+g01b65bf-4+deb8u19 We recommend that you upgrade your wireshark packages. For the detailed security status of wireshark, refer to its security tracker page at: https://security-tracker.debian.org/tracker/wireshark | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-23397 | On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. | 3.6.2-3.7.12 | |
| CM-23285 | When you remove an interface from a bridge and add it to a VRF in the same commit/ifreload, the IPv6 link-local address is not created automatically. To work around this issue, do the change in two separate commits. First, remove the interface from the bridge, which causes it to be a layer 2 interface. Then, enslave the interface to the VRF. | 3.7.2-3.7.8 | 3.7.9-3.7.12 |
| CM-23125 | The OpenSSL package on Cumulus Linux 3.x has a vulnerability similar to CVE-2018-0734. (The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key). According to Debian upstream, this version “is not vulnerable [to CVE-2018-0734 exactly]. Nevertheless, there is a bug fix that futher reduces the amount of leaked timing information. It got no CVE on its own and introduced this vulnerability.“ Vulnerable on CL3: 1.0.1t-1+deb8u12 | 3.0.0-3.7.12 | |
| CM-23123 | When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. | 3.7.2-3.7.12 | |
| CM-23114 | The following CVEs were announced in Debian Security Advisory DSA-4347-1. ————————————————————————————————– Debian Security Advisory DSA-4347-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso November 29, 2018 https://www.debian.org/security/faq ————————————————————————————————– Package: perl CVE ID: CVE-2018-18311 CVE-2018-18312 CVE-2018-18313 CVE-2018-18314 Multiple vulnerabilities were discovered in the implementation of the Perl programming language. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2018-18311 Jayakrishna Menon and Christophe Hauser discovered an integer overflow vulnerability in Perl_my_setenv leading to a heap-basedbuffer overflow with attacker-controlled input. CVE-2018-18312 Eiichi Tsukata discovered that a crafted regular expression could cause a heap-based buffer overflow write during compilation, potentially allowing arbitrary code execution. CVE-2018-18313 Eiichi Tsukata discovered that a crafted regular expression could cause a heap-based buffer overflow read during compilation which leads to information leak. CVE-2018-18314 Jakub Wilk discovered that a specially crafted regular expression could lead to a heap-based buffer overflow. For the stable distribution (stretch), these problems have been fixed in version 5.24.1-3+deb9u5. We recommend that you upgrade your perl packages. For the detailed security status of perl please refer to its security tracker page at: https://security-tracker.debian.org/tracker/perl | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-23096 | The following CVEs were announced in Debian Security Advisory DSA-4372-1. ————————————————————————————————– Debian Security Advisory DSA-4346-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso November 27, 2018 https://www.debian.org/security/faq ————————————————————————————————– Package: ghostscript CVE ID: CVE-2018-19409 CVE-2018-19475 CVE-2018-19476 CVE-2018-19477 Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service or the execution of arbitrary code if a malformed Postscript file is processed (despite the -dSAFER sandbox being enabled). This update rebases ghostscript for stretch to the upstream version 9.26 which includes additional changes. For the stable distribution (stretch), these problems have been fixed in version 9.26~dfsg-0+deb9u1. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript please refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-23075 | There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:2018-11-10T23:35:30.992370-08:00 Dev dhcrelay: Listening on LPF/vlan.101/a0:00:00:00:00:51 2018-11-10T23:35:30.993472-08:00 Dev dhcrelay: Sending on LPF/vlan.101/a0:00:00:00:00:51 Eventually the dhcrelay service stops. | 3.7.1-3.7.12 | |
| CM-23021 | When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. | 3.7.1-3.7.12 | |
| CM-23016 | When FRR restarts, snmp<span class="error">[err]</span> dev/kmem: Permission denied error messages are recorded in the log file and SNMPd might crash periodically. | 3.7.5-3.7.10 | 3.7.11-3.7.12 |
| CM-23004 | The local fallback account authenticates using the local password when the RADIUS or TACACS service is up. The expected behavior is for this to fail and only succeed when the RADIUS OR TACACS server fails to respond. | 3.7.1-3.7.12 | |
| CM-22937 | NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation.To work around this issue, stop snmpd, remove the cache file, then restart snmpd. | 3.6.0-3.7.12 | |
| CM-22849 | When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur.This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. | 3.7.2-3.7.12 | |
| CM-22834 | In rare cases, certain IPv6 BGP peers fail to reestablish after switchd restarts. | 3.7.2-3.7.8 | 3.7.9-3.7.12 |
| CM-22808 | When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. | 3.5.2-3.7.12 | |
| CM-22794 | The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. | 3.6.2-3.7.12 | |
| CM-22608 | Mellanox Spectrum and Helix4 switches occasionally send malformed packets and do not send any flow samples (only counters). While this issue is fixed for switches with the Spectrum ASIC, this is a known limitation on this Helix4 platform. | 3.6.2-3.7.8 | 3.7.9-3.7.12 |
| CM-22605 | On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0.To work around this issue:
| 3.5.3-3.7.10 | 3.7.11-3.7.12 |
| CM-22591 | CVE-2018-5391 (FragmentSmack) is a network vulnerability where an attacker can trigger time and calculation expensive fragment reassembly with specially crafted packets, leading to a denial of service. On a Cumulus Linux switch, the impact is limited to control plane and management plane traffic. Any control plane traffic coming in the front panel ports will be limited by existing policer ACLs. To work around this issue, create a file called /etc/sysctl.d/ip.conf and add these settings:net.ipv4.ipfrag_low_thresh = 196608 | 3.7.0-3.7.11 | 3.7.12 |
| CM-22583 | Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. | 3.6.0-3.7.12 | |
| CM-22554 | If you try to bring down several members of a bond remotely at the same time, the link state of one of the interfaces might not transition correctly to the down state; however, all links show down in hardware. | 3.6.2-3.7.12 | |
| CM-22538 | When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:/etc/frr/daemons was modified by another user. Despite this error, the change is made and the description is removed from the frr.conf file. | 3.6.2-3.7.10 | 3.7.11-3.7.12 |
| CM-22386 | The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. | 3.7.0-3.7.12 | |
| CM-22301 | For an unresolved address, the IPROUTER default policer rule has been modified to not match on packets exiting a TUNNEL and headed to the CPU to resolve the address via ARP. As a result, the following default rule no longer matches TUNNEL ingress packets.A $INGRESS_CHAIN –in-interface $INGRESS_INTF -m addrtype –dst-type IPROUTER -j POLICE –set-mode pkt –set-rate 400 –set-burst 100 These packets are now policed by catch all rules. To work around this issue, the VPORT value on a TRIDENT switch must be changed from binary 011 to 100. | 3.6.1-3.7.12 | |
| CM-22287 | On the EdgeCore AS7712 (Tomahawk) switch running in atomic mode, when a layer 3 ECMP path is brought down, traffic traversing the path stops working for about four seconds. When the switch is changed to non-atomic mode, the delay is less than one second. This issue is seen across OSPF and static ECMP routes. | 3.6.2-3.7.12 | |
| CM-22277 | On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-22274 | To ease interoperation with non-Cumulus devices, it is possible to configure the route-target import and export values under the layer 2 VNI EVPN configuration. The same configuration does not work for both layer 2 VNI and layer 3 VNIs. Set the EVPN address-family within the VNI context when configuring the route-target in the layer 2 VNI. Set the EVPN address-family without the VNI context when configuring the route-target in the layer 3 VNI. | 3.6.0-3.7.12 | |
| CM-22252 | On the Edgecore OMP-800, there is no Power Supply information from the sensor or from smonctl. The platform driver has support for the PSUs but this was not added to the sensors infrastructure.This is a known limitation on the OMP-800 platform. | 3.6.2-3.7.12 | |
| CM-22228 | On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.12 | |
| CM-22205 | If a user is in vtysh when FRR is restarted, the running configuration in that vtysh session shows empty. | 3.6.2-3.7.12 | |
| CM-22203 | By default, the nginx server used for the HTTP API on port 8080 is enabled, but does not listen to external requests. However, it appears to be listening and answering external requests. | 3.6.1-3.7.8 | 3.7.9-3.7.12 |
| CM-22138 | When you run the NCLU net show system command or the NetQ netq inventory command on the Edgecore OMP-800 switch, the output does not show any port or chip information. | 3.6.2-3.7.12 | |
| CM-22041 | At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. | 3.4.3-3.7.12 | |
| CM-22020 | On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. | 3.7.0-3.7.12 | |
| CM-21927 | When running ifreload on Mellanox Spectrum devices, after updating an interface configuration, sometimes VLANs are not programmed into the hardware data plane. The Linux control plane looks normal but the VLAN has not been programmed into the hardware and packets that arrive for the VLAN might be dropped.To work around this issue, remove and re-add the affected VLANs from the port. | 3.5.3-3.7.12 | |
| CM-21898 | On a Trident3 switch, IGMP packets are not policed by the police rule in the 00control ACL file. The packets are policed by the catchall policer in the 99control ACL file instead.-A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police --set-mode pkt --set-rate 100 --set-burst 100To work around this issue, let the CPU bound IGMP packet hit the following rule and change the policer rate to a desired value for IGMP packets: -A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police --set-mode pkt --set-rate 100 --set-burst 100Typically, the destination MAC address 01:00:5e:xx:xx:xx is used only for PIM/IGMP control and data stream packets. However, this workaround cannot handle data stream multicast packets that are not TCP/UDP; this is not typically done. | 3.6.2-3.7.12 | |
| CM-21785 | The source address of the ICMPv6 time exceeded message (traceroute hop) is sourced from the wrong VRF when the traceroute target resides on the same switch but in a different VRF. | 3.6.2-3.7.12 | |
| CM-21769 | On the Mellanox switch, GRE tunneling does not work if the tunnel source is configured on an SVI interface. If the tunnel source is configured on a physical switch port, then tunneling works as expected. | 3.6.1-3.7.12 | |
| CM-21678 | On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty: cumulus@switch:~$ netq show sensors temp changes | grep absent | grep -v psu P2Leaf01 temp9 networking asic die temp sensor absent 43 105 100 5 Unable to find driver path: /cumulu Add 7d:22h:1m:41s P2Leaf01 temp6 networking asic die temp sensor absent 45 105 100 5 Unable to find driver path: /cumulu Add 7d:22h:1m:41s P2Leaf01 temp6 networking asic die temp sensor absent 47 105 100 5 Unable to read temp4_highest Add 9d:23h:26m:6s P2Leaf01 temp6 networking asic die temp sensor absent 45 105 100 5 Unable to read temp4_highest Add 14d:22h:46m:45s This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response. | 3.5.3-3.7.12 | |
| CM-21667 | FRR does not add BGP ttl-security to either the running configuration or to the /etc/frr/frr.conf file when configured on a peer group instead of a specific neighbor.To work around this issue, add ttl-security to individual neighbors instead of the peer group. | 3.6.1-3.7.12 | |
| CM-21511 | If a VNI is configured before the bridge in /etc/network/interfaces, the switch does not send IGMP queries.To work around this issue, edit the /etc/network/interfaces file to define the bridge before the VNI. For example:# The primary network interface auto eth0 iface eth0 inet dhcp auto lo iface lo inet loopback address 10.26.10.11/32 auto swp9 iface swp9 bridge-access 100 auto swp10 iface swp10 bridge-access 100 auto bridge iface bridge bridge-ports swp9 swp10 vni-10 bridge-vids 100 bridge-vlan-aware yes bridge-mcquerier 1 auto vni-10 iface vni-10 vxlan-id 10 vxlan-local-tunnelip 10.0.0.11 bridge-access 100 auto bridge.100 vlan bridge.100 bridge-igmp-querier-src 123.1.1.1 auto vlan100 iface vlan100 address 10.26.100.2/24 vlan-id 100 vlan-raw-device bridge . | 3.6.1-3.7.8 | 3.7.9-3.7.12 |
| CM-21379 | If a primary route becomes unavailable (for example, you run ifdown on the switch port), the backup route remains inactive and is not installed into FIB.To work around this issue, configure routes as ECMP: cumulus@switch:~$ net del routing route 4.1.1.0/24 1.1.1.1 10 cumulus@switch:~$ net add routing route 4.1.1.0/24 1.1.1.1 cumulus@switch:~$ net commit | 3.5.3-3.7.12 | |
| CM-21373 | Debian issued the following security advisory, DSA-4231-1, which affects the libgcrypt20 package. This advisory applies only to the the Debian Stretch release. Debian Jessie, upon which Cumulus Linux 3.0 - 3.6.2 is based, is vulnerable. CVE-2018-0495 It was discovered that Libgcrypt is prone to a local side-channel attack allowing recovery of ECDSA private keys. For the stable distribution (stretch), this problem has been fixed in version 1.7.6-2+deb9u3. We recommend that you upgrade your libgcrypt20 packages. For the detailed security status of libgcrypt20, refer to its security tracker page at: https://security-tracker.debian.org/tracker/libgcrypt20 | 3.6.2-3.7.10 | 3.7.11-3.7.12 |
| CM-21332 | When two VLAN subinterfaces are bridged to each other in a traditional mode bridge, switchd doesn’t assign a gport to the subinterface, even though a gport is expected for each VLAN subinterface.To work around this issue, you can do one of two things:
| 3.5.3-3.7.12 | |
| CM-21278 | The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment. | 3.5.3-3.7.10 | 3.7.11-3.7.12 |
| CM-21058 | The advertised routes list may be empty for an EVPN peering even though the remote switch reports received routes. | 3.6.0-3.7.12 | |
| CM-21055 | On the Mellanox switch, the destination MAC address of ERSPAN GRE packets is set to all zeros; therefore, the first transit switch might drop packets. | 3.6.0-3.7.12 | |
| CM-20966 | The NCLU net show lldp and net show interface commands do not show LLDP information for swp* (eth is unaffected). | 3.6.0-3.7.8 | 3.7.9-3.7.12 |
| CM-20813 | Span rules matching the out-interface as a bond do not mirror packets. | 3.6.0-3.7.12 | |
| CM-20809 | The following CVEs were announced in a Debian Security Advisory. ————————————————————————————————– It was discovered that Ghostscript incorrectly handled certain PostScript files. An attacker could possibly use this to cause a denial of server. (CVE-2016-10317) It was discovered that Ghostscript incorrectly handled certain PDF files. An attacker could possibly use this to cause a denial of service. (CVE-2018-10194) Debian CVE links: https://security-tracker.debian.org/tracker/CVE-2016-10317 and https://security-tracker.debian.org/tracker/CVE-2018-10194 | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-20693 | In NCLU, you can only set the community number in a route map. You cannot set other community options such as no-export, no-advertise, or additive.This is a known limitation in network-docopt and is documented in the Cumulus Linux user guide. | 3.5.1-3.7.12 | |
| CM-20534 | The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.10 | 3.7.11-3.7.12 |
| CM-20508 | The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. | 3.5.3-3.7.12 | |
| CM-20480 | The python-crypto package, which is not installed by default on Cumulus Linux, but is present in the repository to be installed, has the following security vulnerability in the version available for Cumulus Linux 3.x: CVE-2018-6594: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto’s ElGamal implementation. More information at https://security-tracker.debian.org/tracker/CVE-2018-6594 . | 3.0.0-3.7.12 | |
| CM-20132 | On Trident2 switches running 802.3x regular link pause, pause frames are accounted in HwIfInDiscards counters and are dropped instead of processed. | 3.5.2-3.7.10 | 3.7.11-3.7.12 |
| CM-20033 | The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down. | 3.5.2-3.7.12 | |
| CM-19960 | The following CVEs were announced in Debian Security Advisory DSA-4131. ——————————————————————————————- Debian Security Advisory DSA-4131-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff March 04, 2018 https://www.debian.org/security/faq —————————————————————————————— Package: xen CVE ID: CVE-2018-7540 CVE-2018-7541 CVE-2018-7542 Multiple vulnerabilities have been discovered in the Xen hypervisor: CVE-2018-7540 Jann Horn discovered that missing checks in page table freeing may result in denial of service. CVE-2018-7541 Jan Beulich discovered that incorrect error handling in grant table checks may result in guest-to-host denial of service and potentially privilege escalation. CVE-2018-7542 Ian Jackson discovered that insufficient handling of x86 PVH guests without local APICs may result in guest-to-host denial of service. For the stable distribution (stretch), these problems have been fixed in version 4.8.3+comet2+shim4.10.0+comet3-1+deb9u5. We recommend that you upgrade your xen packages. For the detailed security status of xen please refer to its security tracker page at: https://security-tracker.debian.org/tracker/xen | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-19788 | If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict.To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. | 3.5.0-3.7.12 | |
| CM-19724 | PIM and MSDP entries are set to the internal COS value of 6 so they are grouped together with the bulk traffic priority group in the default traffic.conf file. However, PIM, IGMP, and MSDP are considered control-plane and should be set to the internal COS value of 7. | 3.5.2-3.7.12 | |
| CM-19454 | When you use NCLU to bring a bond admin down (net add bond <bond> link down), the bond interface goes into admin down state but the switch ports enslaved to the bond remain UP. If you are using bond-lacp-bypass-allow or balance-xor mode, the host might continue to send traffic. This traffic will be dropped because although the bond slaves are UP, they are not members of the bridge.To work around this issue, use the sudo ifdown <bondname> command. | 3.5.0-3.7.12 | |
| CM-18727 | On the Mellanox SN-2100 switch, unicast packets are counted in multicast queue counters. | 3.4.3-3.7.10 | 3.7.11-3.7.12 |
| CM-18537 | Drops due to congestion do not appear to be counted on a Mellanox switch. To work around this issue, run the sudo ethtool -S swp1 command to collect interface traffic statistics. | 3.4.2-3.7.8 | 3.7.9-3.7.12 |
| CM-17934 | FRR tracks interface speed based on the value it learns from the Linux kernel for that interface. If the interface speed changes, FRR does not update its interface speed cache. This can lead to issues for routing protocols that derive metrics from interface speed as the cost can become out of sync with the interface speed. To work around this issue, manually define the routing protocol metric for these interfaces or restart FRR. | 3.7.6-3.7.12 | |
| CM-17557 | When sFlow is enabled, some sampled packets, such as IPMC, are forwarded twice (in the ASIC and then again through the kernel networking stack). | 3.4.0-3.7.12 | |
| CM-17494 | In certain cases, a peer device sends an ARP request from a source IP address that is not on the connected subnet and the switch creates a STALE neighbor entry. Eventually, the switch attempts to keep the entry fresh and sends ARP requests to the host. If the host responds, the switch has REACHABLE neighbor entries for hosts that are not on the connected subnet. To work around this issue, change the value of arp_ignore to 2. See Default ARP Settings in Cumulus Linux for more information. | 3.3.2-3.7.12 | |
| CM-16855 | If a two nodes on both sides of a link change from auto-negotiation off to auto-negotiation on for both sides during a short interval (around one second), the link might start flapping or stay down.To work around this issue and stop the flapping, turn the link down on the switch with the command ifdown swpX, wait a few seconds, then bring the link back up with the command ifup swpX. Repeat this on the other side if necessary. | 3.3.2-3.7.12 | |
| CM-16571 | NCLU cannot manage rsyslog to addresses routed via a VRF. In Cumulus Linux 4.0.0 and later, management VRF is enabled by default. To work around this issue, update the /etc/network/interfaces file to disable management VRF. | 3.4.3-3.7.12 | |
| CM-16461 | After booting a Cumulus VX virtual machine running the VMware OVA image, sometimes messages from sensors appear, indicating that the “Avg state” is critical, with all values displayed as 100.0. A cl-support is generated. | 3.4.2-3.7.12 | |
| CM-15812 | Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. | 3.2.1-3.7.12 | |
| CM-15601 | On a Mellanox switch in an MLAG environment, a packet from a dually connected host might ingress on one switch but the MAC DA is destined to the router on the peer switch. The packet will traverse the peer link but is not excluded from port isolation (or egress mask) filtering. Similarly, an IP multicast packet might traverse the peer link and need to be routed. | 3.6.2-3.7.12 | |
| CM-15278 | During a link flap test, you might occasionally see a message similar to: warning: swp6: netlink: cannot set link swp6 down: <span class="error">[Errno 98]</span> Address already in use. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-15094 | Counter samples for an 80G bond (2 x 40G) exported from the switch show an interface speed (ifSpeed) of 14.464Gbps. | 3.2.0-3.7.12 | |
| CM-13316 | When you try to remove a VNI from a bridge using a regex match, the VNI is added back when you run the ifreload -a command. | 3.1.1-3.7.10 | 3.7.11-3.7.12 |
Fixed issues in 3.7.7
| Issue ID | Description | Affects |
|---|---|---|
| CM-25415 | In a typical CLOS network, each leaf is connected to all spine nodes; VXLAN packets follow leaf-spine links. However certain failure scenarios or maintenance activity might result in the MLAG primary switch being isolated from the spine layer (the only available network path is now across the peer link). As a result, the MLAG primary switch fails to transmit VXLAN encapsulated packets out on the peer link. It is also possible for the MLAG secondary switch to be isolated from the spine layer and then the problem is seen on the MLAG secondary switch. The issue occurs because the Broadcom Trident3 switch does not perform VLAN translation for VXLAN encapsulated packets where the tunnel is not terminated. To work around this issue, configure the BGP peering on a new VLAN interface (for example, vlan4093) instead of the peer link sub-interface (peerlink.4094). | 3.7.6 |
| CM-25403 | When all ports are split into 4X on the EdgeCore AS7726 switch, switchd fails to start up and a crash is seen in syslog. | 3.7.5-3.7.6 |
| CM-25325 | The following CVEs were announced in Debian Security Advisory DSA-4462-1 and affect the dbus package. ———————————————————————————————- Debian Security Advisory DSA-4462-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso June 13, 2019 https://www.debian.org/security/faq ———————————————————————————————- Package : dbus CVE ID : CVE-2019-12749 Debian Bug : 930375 Joe Vennix discovered an authentication bypass vulnerability in dbus, an asynchronous inter-process communication system. The implementation of the DBUS_COOKIE_SHA1 authentication mechanism was susceptible to a symbolic link attack. A local attacker could take advantage of this flaw to bypass authentication and connect to a DBusServer with elevated privileges. The standard system and session dbus-daemons in their default configuration are not affected by this vulnerability. The vulnerability was addressed by upgrading dbus to a new upstream version 1.10.28 which includes additional fixes. For the stable distribution (stretch), this problem has been fixed in version 1.10.28-0+deb9u1. We recommend that you upgrade your dbus packages. For the detailed security status of dbus, refer to its security tracker page at: https://security-tracker.debian.org/tracker/dbus | |
| CM-25208 | SNMP shows 0 for all swp interfaces in the ifSpeed field (bond interfaces, lo and eth0 are not affected and show a value). | 3.7.6 |
| CM-25167 | The clear bgp command does not support multiple address families. For example, the following command clears IPv6 unicast and ignores IPv4 unicast:cumulus@switch:~$ clear bgp l2vpn evpn To clear IPv4 unicast, use the clear ip bgp command. For example, the following command clears IPv4 unicast and ignores IPv6 unicast:cumulus@switch:~$ clear ip bgp l2vpn evpn | 3.0.0-3.7.6 |
| CM-25158 | In Cumulus Linux 3.7.6 and earlier, ifupdown2 does a string comparison to see if two addresses are the same. In Cumulus Linux 3.7.7, ifupdown2 does an integer comparison. For example, in Cumulus Linux 3.7.6 and earlier, hwaddress 00:00:5e:62:f8:02 and hwaddress 00:00:5e:62:f8:2 are not considered to be equal. In Cumulus Linux 3.7.7 and later, they are considered equal since 2 implies a leading zero. | 3.7.5-3.7.6 |
| CM-25141 | A TACACS privilege level 15 user mapped to tacacs15 cannot use net commands even though the user is part of the netedit and/or netshow user group. | 3.7.2-3.7.6 |
| CM-25137 | In a highly-scaled environment, while BGP is undergoing initial convergence, watchfrr times out and bgpd stops responding. | 3.7.5-3.7.6 |
| CM-25117 | If you have a configuration with more than 128 VRFs, BGP routes stop advertising. | 3.7.6 |
| CM-25106 | On the Dell N3048EP switch, the I2C bus might lock and when you log into the console, you see the following message.bcm-iproc-i2c 1803b000.i2c: bus is busyAs a result, temperatures cannot be monitored. However, traffic is not affected (links do not go down). | 3.7.6 |
| CM-25103 | Received EVPN type-5 routes are not installed into the kernel VRF routing table even though the route appears to be correct. The failure to install the default route makes the rack unreachable from the external world. | 3.7.5-3.7.6 |
| CM-25033 | The vtep-ctl list-ports <physical-switch-name> returns ports with the fully qualified domain name of the switch instead of the short hostname. | 3.7.6 |
| CM-25030 | Under certain circumstances (when you reboot or restart the switchd service), a race condition might occur which causes a synchronization issue resulting in hardware misprogramming of the VXLAN tunnel endpoint interface (VTEP). Packets destined out this tunnel are dropped in the egress direction. Packets arriving on this tunnel are dropped in the ingress direction. This is due to a race condition between ASIC and kernel programming that causes the kernel to incorrectly process the link state of a VXLAN interface.To work around this issue, you can bounce the layer 3 SVI for the affected VRF. For example: ifdown vlan123 ; sleep 2 ; ifup vlan123 Run the net show vrf vni command to show a mapping of the layer 3 VNI to layer 3 SVI for the VRF.Note: This workaround is not guaranteed because the race condition cannot be always be avoided. | 3.7.4-3.7.6 |
| CM-24975 | The following CVEs were announced in Debian Security Advisory DSA-4442-1 and affect the ghostscript package. ———————————————————————————————- Debian Security Advisory DSA-4442-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso May 12, 2019 https://www.debian.org/security/faq ———————————————————————————————- Package : ghostscript CVE ID : CVE-2019-3839 A vulnerability was discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service or the execution of arbitrary code if a malformed Postscript file is processed (despite the - -dSAFER sandbox being enabled). For the stable distribution (stretch), this problem has been fixed in version 9.26a~dfsg-0+deb9u3. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.0.0-3.7.6 |
| CM-24968 | If you configure bridge-learning off on a host-facing link in a VXLAN/EVPN environment and are using static FDB entries instead, when you turn bridge-learning on and delete those static entries, they are re-learned as expected in the bridge FDB table, however they are not installed into FRR and a log message is recorded in /var/log/frr/frr.log. | 3.7.5 |
| CM-24933 | In an EVPN configuration, the old MAC/IP route is present in the routing table after an IP mobility event. | 3.7.5-3.7.6 |
| CM-24925 | The following CVEs were announced in Debian Security Advisory DSA-4438-1 and affect the atftp package. ———————————————————————————————- Debian Security Advisory DSA-4438-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso May 07, 2019 https://www.debian.org/security/faq ———————————————————————————————- Package: atftp CVE ID: CVE-2019-11365 CVE-2019-11366 Debian Bug: 927553 Denis Andzakovic discovered two vulnerabilities in atftp, the advanced TFTP server which could result in denial of service by sending malformed packets. For the stable distribution (stretch), these problems have been fixed in version 0.7.git20120829-3.1~deb9u1. We recommend that you upgrade your atftp packages. For the detailed security status of atftp please refer to its security tracker page at: https://security-tracker.debian.org/tracker/atftp | 3.0.0-3.7.6 |
| CM-24895 | On Trident2 switches, egress double-tagged frames incorrectly use 802.1Q outer ethertype instead of 802.1AD. | 3.7.5-3.7.6 |
| CM-24858 | On the Broadcom switch, TPID programming is not reset when there is a configuration change. As a result, you see unexpected packet drops. | 3.6.2-3.7.6 |
| CM-24838 | The poectl -j command output does not show the correct port numbering in JSON; it is off by one. | 3.7.6 |
| CM-24829 | The RADIUS AAA client does the source IP address bind first, then the setsockopt VRF, which causes a failure due to a kernel check for an address mismatch with the VRF. | 3.7.4-3.7.6 |
| CM-24824 | The dhcrelay service crashes when the DHCP relay packet comes back from the server.To work around this issue, remove the --nl flag from the dhcrelay service. | 3.7.3-3.7.6 |
| CM-24805 | The following CVEs were announced in Debian Security Advisory DSA-4436-1 and affect the imagemagick packages. ——————————————————————————————- Debian Security Advisory DSA-4436-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff April 28, 2019 https://www.debian.org/security/faq —————————————————————————————— This update fixes two vulnerabilities in Imagemagick: Memory handling problems and missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed TIFF or Postscript files are processed. For the stable distribution (stretch), these problems have been fixed in version 8:6.9.7.4+dfsg-11+deb9u7. We recommend that you upgrade your imagemagick packages. For the detailed security status of imagemagick, refer to its security tracker page at: https://security-tracker.debian.org/tracker/imagemagick | 3.0.0-3.7.6 |
| CM-24770 | After upgrading the BIOS to 3.21.0.0-6, when you run the reboot, shutdown or init commands with certain options, the switch powers off. To determine the BIOS version of the switch, run:cumulus@switch:~$ sudo dmidecode -s system-version 3.21.0.0-6 | 3.7.5-3.7.6 |
| CM-24712 | On the EdgeCore AS4610-54P switch, at any moment and without warning, your PoE devices might all go down as PoEd crashes and an error message might be logged. There is no functional impact after a restart. | 3.7.6 |
| CM-24676 | On the Dell S3048 switch, ports with FEC disabled show as BaseR on boot up. | 3.7.3-3.7.6 |
| CM-24663 | On the EdgeCore 7326-54X switch, switchd does not start on initial install because the decode-syseeprom command fails. However in ONIE, onie-syseeprom has no issues. | 3.7.5-3.7.6 |
| CM-24645 | The following CVEs were announced in Debian Security Advisory DSA-4433-1 and affect the ruby2.3 package. ——————————————————————————————- Debian Security Advisory DSA-4433-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff April 16, 2019 https://www.debian.org/security/faq ——————————————————————————————- Package : ruby2.3 CVE ID : CVE-2019-8320 CVE-2019-8321 CVE-2019-8322 CVE-2019-8323 CVE-2019-8324 CVE-2019-8325 Several vulnerabilities have been discovered in the Rubygems included in the interpreter for the Ruby language, which may result in denial of service or the execution of arbitrary code. For the stable distribution (stretch), these problems have been fixed in version 2.3.3-1+deb9u6. We recommend that you upgrade your ruby2.3 packages. For the detailed security status of ruby2.3, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ruby2.3 | 3.0.0-3.7.6 |
| CM-24644 | The following CVEs were announced in Debian Security Advisory DSA-4432-1 and affect the ghostscript package. ——————————————————————————————- Debian Security Advisory DSA-4432-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso April 16, 2019 https://www.debian.org/security/faq ——————————————————————————————- Package : ghostscript CVE ID : CVE-2019-3835 CVE-2019-3838 Debian Bug : 925256 925257 Cedric Buissart discovered two vulnerabilities in Ghostscript, the GPL PostScript/PDF interpreter, which could result in bypass of file system restrictions of the dSAFER sandbox. For the stable distribution (stretch), these problems have been fixed in version 9.26a~dfsg-0+deb9u2. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.0.0-3.7.6 |
| CM-24607 | When you commit a configuration change to a VXLAN layer 2 VNI in an MLAG configuration, the peer link on the MLAG secondary switch goes into an STP blocking state. | 3.7.2-3.7.6 |
| CM-24606 | If you modify BFD timers in the /etc/frr/frr.conf file, then run the systemctl reload frr command, the neighbor connections flap. | 3.6.2-3.7.6 |
| CM-24530 | The following CVEs were announced in Debian Security Advisory DSA-4428-1 and affect the systemd package. ——————————————————————————————- Debian Security Advisory DSA-4428-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso April 08, 2019 https://www.debian.org/security/faq ——————————————————————————————- Package : systemd CVE ID : CVE-2019-3842 Jann Horn discovered that the PAM module in systemd insecurely uses the environment and lacks seat verification permitting spoofing an active session to PolicyKit. A remote attacker with SSH access can take advantage of this issue to gain PolicyKit privileges that are normally only granted to clients in an active session on the local console. For the stable distribution (stretch), this problem has been fixed in version 232-25+deb9u11. This update includes updates previously scheduled to be released in the stretch 9.9 point release. We recommend that you upgrade your systemd packages. For the detailed security status of systemd, refer to its security tracker page at: https://security-tracker.debian.org/tracker/systemd | |
| CM-24526 | On Trident3 switches, transit packets larger than 1500 bytes(DF) routed between SVIs is unexpectedly forwarded to the CPU even when the MTU is greater than 9000. This severely limits throughput for routed jumbo frames as packets arriving at a high interval are dropped to the CPU. | 3.7.0-3.7.6 |
| CM-24510 | The following CVEs were announced in Debian Security Advisory DSA-4425-1 and affect the wget package. ——————————————————————————————- Debian Security Advisory DSA-4425-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso April 05, 2019 https://www.debian.org/security/faq ——————————————————————————————- Package : wget CVE ID : CVE-2019-5953 Debian Bug : 926389 Kusano Kazuhiko discovered a buffer overflow vulnerability in the handling of Internationalized Resource Identifiers (IRI) in wget, a network utility to retrieve files from the web, which could result in the execution of arbitrary code or denial of service when recursively downloading from an untrusted server. For the stable distribution (stretch), this problem has been fixed in version 1.18-5+deb9u3. We recommend that you upgrade your wget packages. For the detailed security status of wget, refer to its security tracker page at: https://security-tracker.debian.org/tracker/wget | 3.0.0-3.7.6 |
| CM-24484 | If you have dynamic route leaking configured between any two VRFs and the BGP instance for the default VRF is not defined, removing an import vrf statement crashes bgpd. This occurs even if neither of the leaking VRFs are the default VRF. | 3.7.4-3.7.6 |
| CM-24377 | An incorrect readout of the optical transceiver high temperature alarm threshold (read as 17 degrees centigrade), disables a 100G optical module on Mellanox Spectrum switches. | 3.7.2-3.7.6 |
| CM-24357 | The following CVEs were announced in Debian Security Advisory DSA-4416-1 and affect the wireshark package. ——————————————————————————————- Debian Security Advisory DSA-4416-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso March 24, 2019 https://www.debian.org/security/faq ——————————————————————————————- Package: wireshark CVE ID: CVE-2019-5716 CVE-2019-5717 CVE-2019-5718 CVE-2019-5719 CVE-2019-9208 CVE-2019-9209 CVE-2019-9214 Debian Bug: 923611 It was discovered that Wireshark, a network traffic analyzer, contained several vulnerabilities in the dissectors for 6LoWPAN, P_MUL, RTSE, ISAKMP, TCAP, ASN.1 BER and RPCAP, which could result in denial of service. For the stable distribution (stretch), these problems have been fixed in version 2.6.7-1~deb9u1. We recommend that you upgrade your wireshark packages. For the detailed security status of wireshark, refer to its security tracker page at: https://security-tracker.debian.org/tracker/wireshark | 3.0.0-3.7.6 |
| CM-24255 | The net commit command fails when you try to add a static voice VLAN or delete dot1x configuration for an interface when the port is already authorized. | 3.7.4-3.7.6 |
| CM-24205 | When you delete or add 802.1X configuration on a port in a traditional mode bridge, all the ports are removed from the bridge. | 3.7.4-3.7.6 |
| CM-24047 | The Cumulus Linux switch sometimes sends out ARP request packets with the sender IP address set to 0.0.0.0. | 3.7.2-3.7.6 |
| CM-23952 | If multiple files reference the same module, ifupdown2 user-defined policy overrides do not apply. | 3.7.0-3.7.6 |
| CM-23948 | In FRR, you can remove the default BGP instance even if there are other instances that depend on it, which causes configuration issues. | 3.7.3-3.7.6 |
| CM-23889 | On the Mellanox SN2700 switch, the 100G-LR4 port might have problems establishing a link over a long distance (around 500 miles) through a telco service provider after a flap. If the laser is forced up by the link provider’s equipment, the circuit comes up. However, the circuit cannot survive a flap and the link remains down after a flap event. However, you might have to explicitly disable auto-negotiation and FEC in this scenario. | 3.7.2-3.7.6 |
| CM-23856 | On the QuantaMesh T1048-LY4R, smonctl reports that all power supplies are absent:cumulus@switch:~$ smonctl Fan1 (Fan 1 ): OK Fan2 (Fan 2 ): OK Fan3 (Fan 3 ): OK PSU1 : ABSENT PSU2 : ABSENT PSU1Temp1 (PSU1 Temp1 ): ABSENT PSU1Temp2 (PSU1 Temp2 ): ABSENT PSU2Temp1 (PSU2 Temp1 ): ABSENT PSU2Temp2 (PSU2 Temp2 ): ABSENT Temp1 (Core 0 ): OK Temp2 (Core 1 ): OK Temp3 (Ambient Temp 0 ): OK Temp4 (Ambient Temp 1 ): OK Temp5 (Ambient Temp 2 ): OK Temp6 (Ambient Temp 3 ): OK Temp7 (Ambient Temp 4 ): OK Temp8 (CPU Temp ): OK | 3.7.3-3.7.6 |
| CM-23748 | A dummy interface does not inherit the MTU from a defaults file in /etc/network/ifupdown2/policy.d. A dummy interface is typically used to keep SVI interfaces up when there are no switch ports up that are associated with that VLAN. | 3.7.2-3.7.6 |
| CM-23709 | In a layer 2 VXLAN configuration, where each ECMP path is a layer 3 LACP bond with multiple port members, ECMP hash appears fine for data traffic over VXLAN from one VTEP to another, but the LACP hash is unbalanced. | 3.7.1-3.7.6 |
| CM-23657 | When you flap a VNI with ifdown vni and ifup vni, the value of all MTUs for the SVI lowers to 1500 regardless of the default value set in the /etc/network/ifupdown2/policy.d/mtu.json file. This behavior does not occur if you flap the link with ip link set vni down. | 3.7.2-3.7.6 |
| CM-23116 | Bridging ISIS traffic fails because layer 2 cache rules forward ISIS traffic to the CPU, where it is then dropped. To work around this issue, contact Customer Support. | 3.7.2-3.7.6 |
| CM-22311 | When a VXLAN SVI transitions to a non-VXLAN SVI, the associated VRRP MAC addresses are not removed. After the transition happens, the removal fails as the VXLAN context is lost and you see the following switchd error:2018-09-06T20:38:20.682916+00:00 dell-s6010-01 switchd[5445]: hal_bcm_l3.c:3436 ERR cannot find l3 intf for vlan: 224 mac: 00:00:5e:00:01:01 (-7) 2018-09-06T20:38:20.686105+00:00 dell-s6010-01 switchd[5445]: hal_bcm_l3.c:3436 ERR cannot find l3 intf for vlan: 223 mac: 00:00:5e:00:01:01 (-7) 2018-09-06T20:38:20.773581+00:00 dell-s6010-01 switchd[5445]: hal_bcm_l3.c:3436 ERR cannot find l3 intf for vlan: 112 mac: 00:00:5e:00:01:01 (-7) 2018-09-06T20:38:20.776986+00:00 dell-s6010-01 switchd[5445]: hal_bcm_l3.c:3436 ERR cannot find l3 intf for vlan: 111 mac: 00:00:5e:00:01:01 (-7) | 3.7.5-3.7.6 |
| CM-21853 | The Trident3 switch does not send out sflow flow samples; only counter samples are sent. | 3.7.6 |
| CM-20222 | During system boot, Cumulus Linux reads the /etc/cumulus/ports.conf file to obtain the port speed. The port speed is programmed into the ASIC and synchronized to the kernel. After system boot, the kernel speed shows correctly as it matches the ASIC speed that is derived from the /etc/cumulus/ports.conf file and the cable type. However, if you restart switchd without rebooting the system, switchd synchronizes the speed from the kernel and uses it to program the ASIC. When you change the port speed in the /etc/cumulus/ports.conf file to ether a higher or lower speed (for example from 100G to 40G or from 40G to 100G) and the attached cable can support both speeds, the pre-existing speed is synchronized from the kernel. Consequently, the kernel speed remains at the pre-existing (incorrect) speed. | 3.6.2-3.7.6 |
| CM-20189 | The clagd process might occasionally leak memory, eventually crash, and then restart. During this time, traffic flows over this switch are impacted temporarily. The /var/log/clagd.log file shows a message similar to the following:
| 3.5.3-3.7.6 |
| CM-19052 | The NetQ agent is bundled with Cumulus VX 3.4.3 and later; however, the NetQ agent is not bundled with Cumulus Linux 3.4.3 and later. The NetQ agent has been removed from Cumulus VX 3.7.7. The NetQ agent will be bundled with Cumulus Linux in a future release. | 3.4.3-3.7.6 |
| CM-14975 | On Dell S6000 switches, switchd CPU utilization is high (50% and above) even when there is no configuration and it is idle. | 3.2.1-3.7.6 |
| CM-12967 | When link pause or priority flow control (PFC) is enabled on a Broadcom Tomahawk-based switch and there is over-subscription on a link, the ASIC sends pause frames aggressively, causing the upstream switch to not throttle enough. If you need link pause or PFC functionality, you must use a switch that does not use the Tomahawk ASIC. | 3.1.0-3.7.6 |
3.7.6 Release Notes
Open issues in 3.7.6
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-29740 | The exim4 package available for optional installation on Cumulus Linux 3.x has the following vulnerability:DLA-2213-1 / CVE-2020-12783: Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. The spa authentication driver is not enabled by default. Vulnerable: <= 4.84.2-2+deb8u6 Fixed: 4.84.2-2+deb8u7 | 3.0.0-3.7.12 | |
| CM-29556 | CVE-2020-11868: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp. This affects: ntp-4.2.8p12 (possibly earlier) and ntp-4.2.8p13 The fix for https://bugs.ntp.org/3445 introduced a bug whereby a system that is running ntp-4.2.8p12 or p13 that only has one unauthenticated time source can be attacked in a way that causes the victim’s next poll to its source to be delayed, for as long as the attack is maintained. http://support.ntp.org/bin/view/Main/NtpBug3592 gives the following mitigations if it is not possible to upgrade to a version with the fix:
| 3.0.0-3.7.12 | |
| CM-29518 | The following vulnerability affects the ruby2.1 package, which is installed by default: CVE-2020-10663: The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.1 has an unsafe object creation vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. Vulnerable: 2.1.5-2+deb8u9 Fixed: 2.1.5-2+deb8u10 | 3.0.0-3.7.12 | |
| CM-29484 | The following vulnerability affects libgd2/libgd3: CVE-2018-14553: gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled). Vulnerable: <= 2.1.0-5+deb8u13 Fixed: 2.1.0-5+deb8u14 | 3.0.0-3.7.12 | |
| CM-29483 | The following vulnerability affects imptool: CVE-2020-5208: It’s been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. Vulnerable: <= 1.8.14-4 Fixed: 1.8.14-4+deb8u1 | 3.0.0-3.7.12 | |
| CM-29284 | The following vulnerabilities affect git, which is available in the repository for optional installation: CVE-2020-5260: Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. CVE-2020-11008: Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. | 3.0.0-3.7.12 | |
| CM-29208 | The following vulnerability has been announced in ceph; the associated libraries librados2 and librbd1 are available in the Cumulus Linux 3 repository for optional installation. CVE-2020-1760: It was discovered that there was a header-splitting vulnerability in ceph, a distributed storage and file system. Vulnerable: <= 0.80.7-2+deb8u2 Fixed: 0.80.7-2+deb8u4 | 3.0.0-3.7.12 | |
| CM-29048 | The following vulnerability exists in the ruby2.1 package: CVE-2016-2338: An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer “head” allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow Vulnerable: <= 2.1.5-2+deb8u8 Fixed: 2.1.5-2+deb8u9 | 3.0.0-3.7.12 | |
| CM-29040 | The following issue has been found in e2fsprogs, a package that contains ext2/ext3/ext4 file system utilities:CVE-2019-5188: A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. | 3.0.0-3.7.12 | |
| CM-28993 | The following security vulnerability has been announced that affects the libicu52 package: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. Vulnerable: <= 52.1-8+deb8u7 Fixed: 52.1-8+deb8u8 | 3.0.0-3.7.12 | |
| CM-28992 | The following security vulnerability has been announced: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. | 3.0.0-3.7.12 | |
| CM-28954 | The python-twisted-* packages, which are available for optional installation in Cumulus Linux but are not installed by default, were found to have the following security vulnerabilities: CVE-2020-10808: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request. CVE-2020-10809: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request. | 3.0.0-3.7.12 | |
| CM-28944 | A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted. To work around this issue, reenter the redistribute <connected\|static> route-map <route-map-name> statement in the configuration. | 3.6.2-3.7.12 | |
| CM-28938 | When you install an ACL LOG/DROP rule on a layer 3 ingress interface that is a member of a VRF, traffic that matches this rule is not logged and is still forwarded. To work around this issue, apply the ACL LOG/DROP rule to the VRF device itself or to the layer 2 VNI. | 3.7.6-3.7.12 | |
| CM-28867 | The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12 | |
| CM-28816 | The following security advisory has been announced for bash: CVE-2019-18276 Qualys scan QID 372268 setuid vulnerability When bash or bash scripts are run setuid, bash is supposed to drop privileges, but does so incorrectly, so that an attacker with command access to the shell can use enable -f for runtime loading of a new builtin that calls setuid() to regain dropped privileges.To work around this issue, do not make bash or bash scripts setuid. | 3.0.0-3.7.12 | |
| CM-28811 | The following security vulnerability affects the libvpx1 library:CVE-2020-0034: It was discovered that there was an out-of-bounds buffer read vulnerability in libvpx, a library implementing the VP8 & VP9 videocodecs. | 3.0.0-3.7.12 | |
| CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.12 | |
| CM-28655 | When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.6.1-3.7.12 | |
| CM-28488 | The following CVEs were announced that affect the cron package. All of these require untrusted local user access.CVE-2017-9525 is a local user privilege escalation attack: In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs. CVE-2019-9704, CVE-2019-9705, CVE-2019-9706 are local user denial of service attacks. Note: the fix for CVE-2019-9705 imposes a limitation on the length of a crontab file (the vulnerability was that an unlimited size crontab file could cause excessive memory consumption). https://security-tracker.debian.org/tracker/DLA-1723-1 | 3.0.0-3.7.12 | |
| CM-28487 | The following CVE was announced for rsyslog: CVE-2019-17041 CVE-2019-17042 rsyslogd, when receiving remote log messages and using optional pmaixforwardedfrom or pmcisconames parser modules (not enabled by default on Cumulus Linux), is vulnerable to CVE-2019-17041 and CVE-2019-17042 where malicious messages that appear to be from AIX or Cisco respectively may be caused to skip sanity checks, resulting in incorrect negative lengths causing heap overflows.Do not enable (with $UDPServerRun or $InputTCPServerRun) receiving syslog messages from other hosts by the network. Also, do not enable (with $ModLoad) the vulnerable parsers pmaixforwardedfrom or pmcisconames.<br/>The default /etc/rsyslog.conf file on Cumulus Linux does NOT enable $UDPServerRun or $InputTCPServerRun, so the vulnerability is not network exploitable in the default configuration. In addition, the vulnerable parsers are not enabled in the default configuration. | 3.0.0-3.7.12 | |
| CM-28486 | The following vulnerability has been found in the libgcrypt20 cryptographic library. CVE-2019-13627: there was a ECDSA timing attack. For more information, see https://www.debian.org/lts/security/2020/dla-1931-2.en.html Vulnerable: 1.6.3-2+deb8u7 Fixed: 1.6.3-2+deb8u8 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28485 | The following vulnerability affects libxml2: CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c has a memory leak related to newDoc->oldNs. This can lead to a denial of service. For more information, see https://www.debian.org/lts/security/2019/dla-2048.en.html . Vulnerable: 2.9.1+dfsg1-5+deb8u7 Fixed: 2.9.1+dfsg1-5+deb8u8 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28484 | The following vulnerability affects libbsd, a package containing utility functions from BSD systems. CVE-2016-2090: In function fgetwln() an off-by-one error could triggers a heap buffer overflow. For more information, see https://www.debian.org/lts/security/2019/dla-2052.en.html . Vulnerable: 0.7.0-2 Fixed: 0.7.0-2+deb8u1 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28224 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2019-15890: libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. Vulnerable: <= 2.1+dfsg-12+deb8u11 Fixed: 2.1+dfsg-12+deb8u12 | 3.0.0-3.7.10 | 3.7.11-3.7.12 |
| CM-28223 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-1711: block: iscsi: OOB heap access via an unexpected response of iSCSI Server | 3.0.0-3.7.12 | |
| CM-28222 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-7039: tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code. Vulnerable: <= 2.1+dfsg-12+deb8u12 Fixed: 2.1+dfsg-12+deb8u13 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28219 | The following vulnerability affects sudo, which is installed by default on Cumulus Linux. It is potentially exploitable on Cumulus Linux if pwfeedback (which is NOT enabled by default) is enabled in the /etc/sudoers file. CVE-2019-18634: In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c. For more information, refer to: https://security-tracker.debian.org/tracker/source-package/sudo https://security-tracker.debian.org/tracker/CVE-2019-18634 https://www.sudo.ws/alerts/pwfeedback.html Vulnerable: <= 1.8.10p3-1+deb8u6 Fixed: 1.8.10p3-1+deb8u7 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28091 | Two security issues were found in the Python interface to the apt package manager, which is installed by default on Cumulus Linux; package downloads from unsigned repositories were incorrectly rejected (CVE-2019-15796) and the hash validation relied on MD5 (CVE-2019-15795). For more information, refer to https://security-tracker.debian.org/tracker/source-package/python-apt Vulnerable: 0.9.3.12 Fixed: 0.9.3.13 | 3.0.0-3.7.11 | 3.7.12 |
| CM-28076 | After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom --init command. | 3.6.0-3.7.12 | |
| CM-28007 | When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 | 3.7.12 |
| CM-27947 | Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. | 3.7.0-3.7.11 | 3.7.12 |
| CM-27937 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 One of the listed vulnerabilities is still present in the latest upstream version 2.1+dfsg-12+deb8u12 (the others have been fixed): CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. https://security-tracker.debian.org/tracker/CVE-2017-15124 | 3.0.0-3.7.12 | |
| CM-27924 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.26.dfsg1-13+deb8u1 Fixed: 2.1.26.dfsg1-13+deb8u2 | 3.0.0-3.7.11 | 3.7.12 |
| CM-27855 | The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. | 3.7.0-3.7.11 | 3.7.12 |
| CM-27793 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.27+dfsg-1 Fixed: 2.1.27+dfsg-1+deb10u1 | 3.0.0-3.7.12 | |
| CM-27698 | SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.12 | |
| CM-27683 | The following CVEs were announced that affect the Linux kernel: CVE-2019-12378: An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-12381: An issue was discovered in ip_ra_control in net/ipv4/ip_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-15239: In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation. CVE-2019-19062: A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042. CVE-2019-19537: In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID-303911cfc5b9. This affects drivers/usb/core/file.c. CVE-2019-20054: In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e. | 3.0.0-3.7.11 | 3.7.12 |
| CM-27646 | Several vulnerabilities have been discovered in Git, a fast, scalable, distributed revision control system, which is available in the Cumulus Linux 3.x repositories for optional installation. CVE-2019-1348: export-marks is insecure, fix is to disable by default. CVE-2019-1349: .git / git~1 filename vulnerability on NTFS CVE-2019-1352: .git vulnerability with NTFS Alternate Streams Accesses CVE-2019-1353: NTFS filesystem protection should be on by default CVE-2019-1387: dubiously-nested submodule git directories should be disallowed CVE-2019-19604: submodule update repository code execution vulnerability Vulnerable: <= 2.1.4-2.1+deb8u7 Fixed: 2.1.4-2.1+deb8u8 | 3.0.0-3.7.12 | |
| CM-27628 | The following security vulnerabilities have been announced in the nss/libnss3 library, which is not installed by default but is available in the repository: CVE-2019-11745: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate CVE-2019-17007: nss: Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may crash with a NULL deref leading to DoS See https://security-tracker.debian.org/tracker/source-package/nss for more information. Vulnerable: <= 3.26-1+debu8u7 Fixed: 3.26-1+debu8u9 | 3.0.0-3.7.10 | 3.7.11-3.7.12 |
| CM-27349 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 The latest upstream version 2.1+dfsg-12+deb8u12 fixes the following vulnerabilities listed in that announcement: CVE-2017-15038 Tuomas Tynkkynen discovered an information leak in 9pfs. CVE-2017-15119 Eric Blake discovered that the NBD server insufficiently restricts large option requests, resulting in denial of service. CVE-2017-15268 A memory leak in websockets support may result in denial of service. CVE-2017-15289 Guoxiang Niu discovered an OOB write in the emulated Cirrus graphics adaptor which could result in denial of service. CVE-2017-16845 Cyrille Chatras discovered an information leak in PS/2 mouse and keyboard emulation which could be exploited during instance migration. CVE-2017-17381 Dengzhan Heyuandong Bijunhua and Liweichao discovered that an implementation error in the virtio vring implementation could result in denial of service. CVE-2017-18043 Eric Blake discovered an integer overflow in an internally used macro which could result in denial of service. CVE-2018-5683 Jiang Xin and Lin ZheCheng discovered an OOB memory access in the emulated VGA adaptor which could result in denial of service. CVE-2018-7550 Cyrille Chatras discovered that an OOB memory write when using multiboot could result in the execution of arbitrary code. The following remains vulnerable in 2.1+dfsg-12+deb8u12: CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. Note: qemu is not installed by default, but is available in the repository for optional installation. | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-27295 | IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.[ip6tables] | 3.7.2-3.7.11 | 3.7.12 |
| CM-27279 | When ECMP routes have both VXLAN (symmetric routing) and non-VXLAN paths, the non-VXLAN path is incorrectly installed in the RIB and FIB to point across VXLAN. The non-VXLAN next-hop will be installed as an offload entry in the neighbor table (ip neigh show) with a mac address of 00:00:00:00:00:00. | 3.7.3-3.7.12 | |
| CM-27174 | The ospfd daemon might crash with the following kernel trace:2019-11-06T23:00:08.261749+09:00 cumulus ospfd[5339]: Assertion ‘node’ failed in file ospfd/ospf_packet.c, line 671, function ospf_write | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-27096 | On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10 | 3.7.11-3.7.12 |
| CM-27094 | On the Delta AG9032v1 switch, smonctl and sensors report inaccurate PSU current and power. | 3.5.0-3.7.12 | |
| CM-27025 | On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. | 3.7.2-3.7.10 | 3.7.11-3.7.12 |
| CM-26769 | Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26657 | When you install a large number of new rules with nonatomic mode enabled, there is a chance that you install more rules than the number of available slots in the slice, which results in the slice being completely wiped and reinstalled. This causes a large drop increase, including to cpu0, and might cause a major outage by dropping all BGP sessions. | 3.6.1-3.7.10 | 3.7.11-3.7.12 |
| CM-26525 | When an MLAG peerlink frequently alternates states between learning and blocking, an excessive number of TCP sessions might be created, which results in the following error display:OSError: [Errno 24] Too many open files | 3.6.2-3.7.10 | 3.7.11-3.7.12 |
| CM-26523 | Package: hostapd CVE ID: CVE-2019-13377 CVE-2019-16275 Two vulnerabilities were found in the WPA protocol implementation found in wpa_supplication (station) and hostapd (access point). CVE-2019-13377 A timing-based side-channel attack against WPA3’s Dragonfly handshake when using Brainpool curves could be used by an attacker to retrieve the password. CVE-2019-16275 Insufficient source address validation for some received Management frames in hostapd could lead to a denial of service for stations associated to an access point. An attacker in radio range of the access point could inject a specially constructed unauthenticated IEEE 802.11 frame to the access point to cause associated stations to be disconnected and require a reconnection to the network. Fixed version: 1:2.8.0-cl4u3 | 3.7.0-3.7.10 | 3.7.11-3.7.12 |
| CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.12 | |
| CM-26450 | Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.12 | |
| CM-26272 | On the Mellanox Spectrum switch, a route withdrawal might cause the associated next hop neighbor entry to be deleted in hardware but remain in the kernel. This can cause traffic going through the directly connected route to the removed neighbor entry to be forwarded to the CPU. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26255 | On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26252 | The following CVEs were announced that affect the ghostscript package: CVE ID : CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817 It was discovered that various procedures in Ghostscript, the GPL PostScript/PDF interpreter, do not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.7.0-3.7.10 | 3.7.11-3.7.12 |
| CM-26241 | On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. | 3.7.6-3.7.11 | 3.7.12 |
| CM-26181 | ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).-A FORWARD -i swp+ -j LOG You can now install such rules with swp+. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-26147 | On the EdgeCore AS4610 switch, the ping command fails unless you run the command with sudo.To work around this issue, run the following commands: cumulus@switch:~$ sudo setcap cap_net_raw+ep /usr/share/mgmt-vrf/bin/ping Run the following command to verify the workaround:
You should see the following output:
| 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-26139 | Selective ERSPAN does not work when you specify a bridge port. | 3.7.6-3.7.12 | |
| CM-26138 | You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:-A FORWARD -i swp5 -s 00:25:90:b2:bd:9d -d 50:6b:4b:96:c4:04 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64 | 3.7.6-3.7.12 | |
| CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:-A FORWARD -i vni10 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64 | 3.7.6-3.7.12 | |
| CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.12 | |
| CM-25956 | The following CVEs were announced in Debian Security Advisory DSA-4499-1 and affect the ghostscript package. ————————————————————————————— Debian Security Advisory DSA-4499-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso August 12, 2019 https://www.debian.org/security/faq ————————————————————————————— Package: ghostscript CVE ID: CVE-2019-10216 Debian Bug: 934638 Netanel reported that the .buildfont1 procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. For the oldstable distribution (stretch), this problem has been fixed in version 9.26a~dfsg-0+deb9u4. For the stable distribution (buster), this problem has been fixed in version 9.27~dfsg-2+deb10u1. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-25944 | The following CVEs were announced in Debian Security Advisory DSA-4495 and DSA 4497 and affect the linux kernel package. ——————————————————————————————— Debian Security Advisory DSA-4495-1 security@debian.org https://www.debian.org/security/ Ben Hutchings August 10, 2019 https://www.debian.org/security/faq ——————————————————————————————— Package: linux CVE ID: CVE-2018-20836 CVE-2019-1125 CVE-2019-1999 CVE-2019-10207 CVE-2019-10638 CVE-2019-12817 CVE-2019-12984 CVE-2019-13233 CVE-2019-13631 CVE-2019-13648 CVE-2019-14283 CVE-2019-14284 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2015-8553 Jan Beulich discovered that CVE-2015-2150 was not completely addressed. If a PCI physical function is passed through to a Xen guest, the guest is able to access its memory and I/O regions before enabling decoding of those regions. This could result in a denial-of-service (unexpected NMI) on the host. The fix for this is incompatible with qemu versions before 2.5. (CVE ID not yet assigned) Denis Andzakovic reported a missing type check in the IPv4 multicast routing implementation. A user with the CAP_NET_ADMIN capability (in any user namespace) could use this for denial-of-service (memory corruption or crash) or possibly for privilege escalation. CVE-2018-5995 ADLab of VenusTech discovered that the kernel logged the virtual addresses assigned to per-CPU data, which could make it easier to exploit other vulnerabilities. CVE-2018-20836 chenxiang reported a race condition in libsas, the kernel subsystem supporting Serial Attached SCSI (SAS) devices, which could lead to a use-after-free. It is not clear how this might be exploited. CVE-2019-1125 It was discovered that most x86 processors could speculatively skip a conditional SWAPGS instruction used when entering the kernel from user mode, and/or could speculatively execute it when it should be skipped. This is a subtype of Spectre variant 1, which could allow local users to obtain sensitive information from the kernel or other processes. It has been mitigated by using memory barriers to limit speculative execution. Systems using an i386 kernel are not affected as the kernel does not use SWAPGS. CVE-2019-1999 A race condition was discovered in the Android binder driver, which could lead to a use-after-free. If this driver is loaded, a local user might be able to use this for denial-of-service (memory corruption) or for privilege escalation. CVE-2019-1125 It was discovered that most x86 processors could speculatively skip a conditional SWAPGS instruction used when entering the kernel from user mode, and/or could speculatively execute it when it should be skipped. This is a subtype of Spectre variant 1, which could allow local users to obtain sensitive information from the kernel or other processes. It has been mitigated by using memory barriers to limit speculative execution. Systems using an i386 kernel are not affected as the kernel does not use SWAPGS. CVE-2019-3882 It was found that the vfio implementation did not limit the number of DMA mappings to device memory. A local user granted ownership of a vfio device could use this to cause a denial of service (out-of-memory condition). CVE-2019-3900 It was discovered that vhost drivers did not properly control the amount of work done to service requests from guest VMs. A malicious guest could use this to cause a denial-of-service (unbounded CPU usage) on the host. CVE-2019-10207 The syzkaller tool found a potential null dereference in various drivers for UART-attached Bluetooth adapters. A local user with access to a pty device or other suitable tty device could use this for denial-of-service (BU G/oops). CVE-2019-10638 Amit Klein and Benny Pinkas discovered that the generation of IP packet IDs used a weak hash function, “jhash”. This could enable tracking individual computers as they communicate with different remote servers and from different networks. The “siphash” function is now used instead. CVE-2019-10639 Amit Klein and Benny Pinkas discovered that the generation of IP packet IDs used a weak hash function that incorporated a kernel virtual address. This hash function is no longer used for IP IDs, although it is still used for other purposes in the network stack. CVE-2019-12817 It was discovered that on the PowerPC (ppc64el) architecture, the hash page table (HPT) code did not correctly handle fork() in a process with memory mapped at addresses above 512 TiB. This could lead to a use-after-free in the kernel, or unintended sharing of memory between user processes. A local user could use this for privilege escalation. Systems using the radix MMU, or a custom kernel with a 4 KiB page size, are not affected. CVE-2019-12984 It was discovered that the NFC protocol implementation did not properly validate a netlink control message, potentially leading to a null pointer dereference. A local user on a system with an NFC interface could use this for denial-of-service (BUG/oops). CVE-2019-13233 Jann Horn discovered a race condition on the x86 architecture, in use of the LDT. This could lead to a use-after-free. A local user could possibly use this for denial-of-service. CVE-2019-13631 It was discovered that the gtco driver for USB input tablets could overrun a stack buffer with constant data while parsing the device’s descriptor. A physically present user with a specially constructed USB device could use this to cause a denial-of-service (BUG/oops), or possibly for privilege escalation. CVE-2019-13648 Praveen Pandey reported that on PowerPC (ppc64el) systems without Transactional Memory (TM), the kernel would still attempt to restore TM state passed to the sigreturn() system call. A local user could use this for denial-of-service (oops). CVE-2019-14283 The syzkaller tool found a missing bounds check in the floppy disk driver. A local user with access to a floppy disk device, with a disk present, could use this to read kernel memory beyond the I/O buffer, possibly obtaining sensitive information. CVE-2019-14284 The syzkaller tool found a potential division-by-zero in the floppy disk driver. A local user with access to a floppy disk device could use this for denial-of-service (oops). (CVE ID not yet assigned) Denis Andzakovic reported a possible use-after-free in the TCP sockets implementation. A local user could use this for denial-of-service (memory corruption or crash) or possibly for privilege escalation. (CVE ID not yet assigned) The netfilter conntrack subsystem used kernel addresses as user-visible IDs, which could make it easier to exploit other security vulnerabilities. XSA-300 Julien Grall reported that Linux does not limit the amount of memory which a domain will attempt to baloon out, nor limits the amount of “foreign / grant map” memory which any individual guest can consume, leading to denial of service conditions (for host or guests). For the oldstable distribution (stretch), these problems have been fixed in version 4.9.168-1+deb9u5. For the stable distribution (buster), these problems have been fixed in version 4.19.37-5+deb10u2. For the oldstable distribution (stretch), these problems will be fixed soon. We recommend that you upgrade your linux packages. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.12 | |
| CM-25824 | NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.12 | |
| CM-25796 | Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:ifdown vlan123 ; sleep 2 ; ifup vlan123 You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. | 3.7.5-3.7.12 | |
| CM-25794 | Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.12 | |
| CM-25784 | The following CVEs were announced in Debian Security Advisory DSA-4489-1. ————————————————————————————— Debian Security Advisory DSA-4489-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso July 27, 2019 https://www.debian.org/security/faq ————————————————————————————— Package: patch CVE ID: CVE-2019-13636 CVE-2019-13638 Debian Bug: 932401 933140 Imre Rad discovered several vulnerabilities in GNU patch, leading to shell command injection or escape from the working directory and access and overwrite files, if specially crafted patch files are processed. This update includes a bugfix for a regression introduced by the patch to address CVE-2018-1000156 when applying an ed-style patch (#933140). For the oldstable distribution (stretch), these problems have been fixed in version 2.7.5-1+deb9u2. For the stable distribution (buster), these problems have been fixed in version 2.7.6-3+deb10u1. We recommend that you upgrade your patch packages. For the detailed security status of patch please refer to its security tracker page at: https://security-tracker.debian.org/tracker/patch | 3.0.0-3.7.8 | 3.7.9-3.7.12 |
| CM-25754 | A port that is used as both a double tag interface and a VXLAN access side interface does not forward correctly; VXLAN decapsulation is does not occur. However, do not configure double tagged interfaces on VXLAN uplink ports as this will cause VXLAN routing issues. | 3.6.2-3.7.8 | 3.7.9-3.7.12 |
| CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:cumulus@switch:~$ net add bridge mybridge vlan-protocol 802.1ad | 3.7.6-3.7.12 | |
| CM-25718 | IF-MIB::ifHCInOctets reports significantly lower values than reported by interface counters seen elsewhere. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25694 | If a packet is policed by ebtables, it does not increment an ACL drop on the ingress interface. Instead, it increments the TDBGC3/6 drop counter to the CPU. | 3.7.6-3.7.12 | |
| CM-25693 | After you issue the NCLU net del bgp vrf <vrf> autonomous-system <AS> command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. | 3.7.3-3.7.10 | 3.7.11-3.7.12 |
| CM-25684 | For interfaces configured with RS FEC, when switchd is restarted, the link goes down but does not automatically come back up. This occurs because the FEC status is not replayed correctly into the kernel.To work around this issue, run the ifreload -a command to bring up the interface after switchd is restarted. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25674 | On Mellanox switches, policer iptables are not working as expected. For example, when using a policer with mode KB/MB/GB to rate-limit interfaces, the syntax is accepted but the data plane transfer speed is not affected by the rule. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25672 | snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. | 3.7.4-3.7.10 | 3.7.11-3.7.12 |
| CM-25665 | On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur:
| 3.7.5-3.7.11 | 3.7.12 |
| CM-25646 | When moving an IP address from the address line to inet dhcp, then issuing the ifreload -a command, the old address is not removed from the interface. NCLU still reports the old address only and reports it as a DHCP address. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25641 | If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl.To work around this issue, power cycle the switch. | 3.7.6-3.7.12 | |
| CM-25640 | When you configure the switch to send an EAP request with the net add dot1x send-eap-request-id command, the switch ignores re-authentication attempts and does not send back an EAPol. | 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25619 | After configuring switchd hal.bcm.per_vlan_router_mac_lookup to TRUE on a Broadcom switch, layer 2 traffic works over VXLAN but the host is not able to ping the locally connected gateway and loses routing ability to other IPs and subnets. | 3.6.0-3.7.8 | 3.7.9-3.7.12 |
| CM-25610 | BGP update packets are sometimes missing the mandatory nexthop attribute, which causes connections to reset. For example, this issue is seen when using VRF route leaking with a mix of BGP unnumbered and BGP numbered peers. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25505 | In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result. In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example:
| 3.7.6-3.7.10 | 3.7.11-3.7.12 |
| CM-25489 | When BGP remove-private-AS replace-AS is configured under the BGP IPv4 or IPv6 address family between a pair of switches configured as BGP peers, a BGP route update might cause the BGP session to flap.To work around this issue, do not configure remove-private-AS replace-AS in the BGP IPv4 or IPv6 address family. | 3.7.6-3.7.8 | 3.7.9-3.7.12 |
| CM-25467 | The following CVEs were announced in Debian Security Advisory DSA-4472-1 and affect the expat (libexpat1) package. ————————————————————————————- Debian Security Advisory DSA-4472-1 security@debian.org |