An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent boundary checks that do not account for reading 3 bytes (instead of 2) in this 0xff case.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade frr-selinuxUpgrade frr | Nov 16, 2023 | May 3, 2023 |
| Centos_linux | — | Upgrade frrUpgrade frr-debugsourceUpgrade frr-selinuxUpgrade frr-debuginfo | Nov 8, 2023 | May 3, 2023 |
| Debian | — | Upgrade frr | Sep 12, 2023 | May 3, 2023 |
| Oracle_linux | — | Upgrade frrUpgrade frr-selinux | Jul 22, 2024 | May 3, 2023 |
| Redhat_linux | — | Upgrade frr-selinuxUpgrade frrUpgrade frr-debugsourceUpgrade frr-debuginfo | Nov 8, 2023 | May 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub