An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent boundary checks that do not account for reading 3 bytes (instead of 2) in this 0xff case. NOTE: this behavior occurs in bgp_open_option_parse in the bgp_open.c file, a different location (with a different attack vector) relative to CVE-2022-40302.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-frralma-upgrade-frr-selinux | Nov 16, 2023 | May 3, 2023 | |
| Centos_linux | — | centos-upgrade-frrcentos-upgrade-frr-debuginfocentos-upgrade-frr-debugsourcecentos-upgrade-frr-selinux | Nov 8, 2023 | May 3, 2023 |
| Debian | debian-upgrade-frr | Sep 12, 2023 | May 3, 2023 | |
| Oracle_linux | — | oracle-linux-upgrade-frroracle-linux-upgrade-frr-selinux | Jul 22, 2024 | May 3, 2023 |
| Redhat_linux | redhat-upgrade-frrredhat-upgrade-frr-debuginforedhat-upgrade-frr-debugsourceredhat-upgrade-frr-selinux | Nov 8, 2023 | May 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub