Arista EOS (EVPN VXLAN MAC/IP binding): TENANT ISOLATION: malformed packets create incorrect MAC-to-IP bindings

Impact

TENANT ISOLATION: malformed packets create incorrect MAC-to-IP bindings in an EVPN VXLAN fabric, and packets get forwarded across VLAN boundaries as a result. An attacker who can source crafted frames from inside one tenant's overlay can poison the fabric's bindings and cause traffic to cross into the wrong VLAN. The advisory notes traffic is discarded on the receiving VLAN, which limits it to a leak-and-drop rather than a clean interception — but it is still a control-plane-driven breach of the segmentation model.

Who can reach it

A host inside an EVPN VXLAN tenant network able to emit specific malformed packets.

What to do

EOS upgrade plus reload across the VTEP layer. No live workaround. If you run EVPN multi-tenancy, also audit the MAC/IP binding table for entries that do not correspond to a real workload.

References