CVE-2024-55553:
In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the
total size of an update received via RTR exceeds the internal socket's buffer size,
default 4K on most OSes. An attacker can use this to trigger re-parsing of the RIB
for FRR routers using RTR by causing more than this number of updates during an update
interval (usually 30 minutes). Additionally, this effect regularly occurs organically.
Furthermore, an attacker can use this to trigger route validation continuously.
Given that routers with large full tables may need more than 30 minutes to fully
re-validate the table, continuous issuance/withdrawal of large numbers of ROA may be
used to impact the route handling performance of all FRR instances using RPKI globally.
Additionally, the re-validation will cause heightened BMP traffic to ingestors.
Fixed Versions: 10.0.3, 10.1.2, 10.2.1, >= 10.3.
Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-55553]
[https://frrouting.org/security/cve-2024-55553/]
Upstream patch: backport [b0800bfdf0]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2024-27913:
ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1
allows remote attackers to cause a denial of service (ospfd daemon
crash) via a malformed OSPF LSA packet, because of an attempted
access to a missing attribute field.
CVE-2024-34088:
In FRRouting (FRR) through 9.1, it is possible for the get_edge()
function in ospf_te.c in the OSPF daemon to return a NULL pointer.
In cases where calling functions do not handle the returned NULL
value, the OSPF daemon crashes, leading to denial of service.
CVE-2024-31950:
In FRRouting (FRR) through 9.1, there can be a buffer overflow and
daemon crash in ospf_te_parse_ri for OSPF LSA packets during an attempt
to read Segment Routing subTLVs (their size is not validated).
CVE-2024-31951:
In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1,
there can be a buffer overflow and daemon crash in
ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read
Segment Routing Adjacency SID subTLVs (lengths are not validated).
CVE-2024-31948:
In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID
attribute in a BGP UPDATE packet can cause the bgpd daemon to crash.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-27913]
[https://nvd.nist.gov/vuln/detail/CVE-2024-34088]
[https://nvd.nist.gov/vuln/detail/CVE-2024-31951]
[https://nvd.nist.gov/vuln/detail/CVE-2024-31950]
[https://nvd.nist.gov/vuln/detail/CVE-2024-31948]
Upstream patches:
[a73e66d073]
[8c177d69e3]
[5557a289ac]
[f69d1313b1]
[babb23b748]
[ba6a8f1a31]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
An issue was discovered in FRRouting (FRR) through 10.1.
bgp_attr_encap in bgpd/bgp_attr.c does not check the actual
remaining stream length before taking the TLV value.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-44070
Upstream patch:
0998b38e4d
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec
in bgpd/bgp_flowspec.c processes malformed requests with no attributes,
leading to a NULL pointer dereference.
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-41909https://security-tracker.debian.org/tracker/CVE-2023-41909
Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
[Minor fixup ]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2023-38802:
FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote
attacker to cause a denial of service via a crafted BGP update with a
corrupted attribute 23 (Tunnel Encapsulation).
CVE-2023-41358:
An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c
processes NLRIs if the attribute length is zero.
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-38802https://nvd.nist.gov/vuln/detail/CVE-2023-41358
Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to
cause a denial of service via the bgp_attr_psid_sub() function.
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-31490https://github.com/FRRouting/frr/issues/13099
Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
[Fixup so patch would apply]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to
cause a denial of service via the bgp_capability_llgr() function.
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-31489https://github.com/FRRouting/frr/issues/13098
Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
[Refactored to get it to apply]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Add a security fix cherry-picked from master:
CVE-2022-40318:
An out-of-bounds read exists in the BGP daemon of FRRouting FRR through
8.4. When sending a malformed BGP OPEN message that ends with the option
length octet (or the option length word, in case of an extended OPEN
message), the FRR code reads of out of the bounds of the packet,
throwing a SIGABRT signal and exiting. This results in a bgpd daemon
restart, causing a Denial-of-Service condition.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2022-43681https://cyberriskleaders.com/new-vulnerabilities-disclosed-in-frrouting-software/
Patch from:
766eec1b7a
Signed-off-by: Jonas Gorski <jonas.gorski@bisdn.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Add a security fix from the stable/8.2 branch:
CVE-2022-40318:
An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By
crafting a BGP OPEN message with an option of type 0xff (Extended Length
from RFC 9072), attackers may cause a denial of service (assertion
failure and daemon restart, or out-of-bounds read). This is possible
because of inconsistent boundary checks that do not account for reading
3 bytes (instead of 2) in this 0xff case. NOTE: this behavior occurs in
bgp_open_option_parse in the bgp_open.c file, a different location (with
a different attack vector) relative to CVE-2022-40302.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2022-40318https://cyberriskleaders.com/new-vulnerabilities-disclosed-in-frrouting-software/
Patch from:
72088b05d4
Signed-off-by: Jonas Gorski <jonas.gorski@bisdn.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Add a security fix from the stable/8.2 branch for two CVEs for the same
vulneratiblity:
CVE-2022-36440:
A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the
peek_for_as4_capability function. Attackers can maliciously construct
BGP open packets and send them to BGP peers running frr-bgpd, resulting
in DoS.
CVE-2022-40302:
An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By
crafting a BGP OPEN message with an option of type 0xff (Extended Length
from RFC 9072), attackers may cause a denial of service (assertion
failure and daemon restart, or out-of-bounds read). This is possible
because of inconsistent boundary checks that do not account for reading
3 bytes (instead of 2) in this 0xff case.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2022-36440https://nvd.nist.gov/vuln/detail/CVE-2022-40302https://cyberriskleaders.com/new-vulnerabilities-disclosed-in-frrouting-software/https://github.com/FRRouting/frr/issues/13202
Patch from:
02a0e45f66
Signed-off-by: Jonas Gorski <jonas.gorski@bisdn.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2022-37032:
An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may
lead to a segmentation fault and denial of service. This occurs in
bgp_capability_msg_parse in bgpd/bgp_packet.c.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2022-37032
Patch from:
3c4821679f
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2022-37035:
An issue was discovered in bgpd in FRRouting (FRR) 8.3. In
bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c,
there is a possible use-after-free due to a race condition. This could
lead to Remote Code Execution or Information Disclosure by sending
crafted BGP packets. User interaction is not needed for exploitation.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2022-37035
Patch from:
71ca5b09bc
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
There is a parallel build error in separate build directory:
| /home/pokybuild/yocto-worker/meta-oe/build/build/tmp/work/core2-64-poky-linux/frr/8.2.2-r0/recipe-sysroot-native/usr/lib/clippy ../git/python/clidef.py -o isisd/isis_cli_clippy.c ../git/isisd/isis_cli.c
| Traceback (most recent call last):
| File "../git/python/clidef.py", line 466, in <module>
| clippy.wrdiff(
| File "/home/pokybuild/yocto-worker/meta-oe/build/build/tmp/work/core2-64-poky-linux/frr/8.2.2-r0/git/python/clippy/__init__.py", line 78, in wrdiff
| with open(newname, "w") as out:
| FileNotFoundError: [Errno 2] No such file or directory: 'isisd/isis_cli_clippy.c.new-372541'
| make[1]: Leaving directory '/home/pokybuild/yocto-worker/meta-oe/build/build/tmp/work/core2-64-poky-linux/frr/8.2.2-r0/build'
| make[1]: *** [Makefile:17386: isisd/isis_cli_clippy.c] Error 1
This is beacuse clidef.py only creates new file but doesn't check if
parent directory exists. Inherit autotools-brokensep can fix this issue
as these parent directories always exist in source directory.
Also set ac_cv_path_PERL to '/usr/bin/env perl' to avoid path too long.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 09a97158f80a779c3f45b3189adcddbd535e5baf)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
FRRouting (FRR) is a free and open source Internet routing protocol
suite for Linux and Unix platforms. It implements BGP, OSPF, RIP, IS-IS,
PIM, LDP, BFD, Babel, PBR, OpenFabric and VRRP, with alpha support for
EIGRP and NHRP.
FRRouting is a fork of Quagga. The main git lives on
https://github.com/frrouting/frr.git
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
