In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/etc/frr) and replacing config files upon creation with, for example, symlinks to change the ownership of arbitrary files. This is a TOCTOU Race Condition caused by a combination of touch and chown.
CVSS Details
- CVSS 3.1 Base Score: 6.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | No solution exists | Sep 15, 2026 | Sep 13, 2026 |
| Suse | — | Upgrade libmlag_pb0Upgrade libfrrzmq0Upgrade libfrr_pb0Upgrade frrUpgrade frr-develUpgrade libfrr0Upgrade libfrrfpm_pb0Upgrade libfrrcares0Upgrade libfrrospfapiclient0Upgrade libfrrgrpc_pb0Upgrade libfrrsnmp0 | Nov 21, 2022 | Nov 18, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub