Frrouting

An issue was discovered in FRRouting (FRR) through 10.1

CVE-2024-44070 7.5 - High - August 19, 2024

An issue was discovered in FRRouting (FRR) through 10.1. bgp_attr_encap in bgpd/bgp_attr.c does not check the actual remaining stream length before taking the TLV value.

bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow

CVE-2023-38406 9.8 - Critical - November 06, 2023

bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow."

Improper Handling of Exceptional Conditions

bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing.

CVE-2023-38407 7.5 - High - November 06, 2023

bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing.

An issue was discovered in FRRouting FRR through 9.0.1

CVE-2023-47234 7.5 - High - November 03, 2023

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path attributes).

An issue was discovered in FRRouting FRR through 9.0.1

CVE-2023-47235 7.5 - High - November 03, 2023

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw outcome.

An issue was discovered in FRRouting FRR through 9.0.1

CVE-2023-46752 5.9 - Medium - October 26, 2023

An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.

An issue was discovered in FRRouting FRR through 9.0.1

CVE-2023-46753 5.9 - Medium - October 26, 2023

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an unknown transit attribute.

An issue was discovered in FRRouting FRR through 9.0

CVE-2023-41909 7.5 - High - September 05, 2023

An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference.

NULL Pointer Dereference

FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2

CVE-2023-38802 7.5 - High - August 29, 2023

FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).

Improper Validation of Integrity Check Value

An issue was discovered in FRRouting FRR through 9.0

CVE-2023-41358 7.5 - High - August 29, 2023

An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.

NULL Pointer Dereference

An issue was discovered in FRRouting FRR through 9.0

CVE-2023-41359 9.1 - Critical - August 29, 2023

An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for the availability of two bytes during AIGP validation.

Out-of-bounds Read

An issue was discovered in FRRouting FRR through 9.0

CVE-2023-41360 9.1 - Critical - August 29, 2023

An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.

Out-of-bounds Read

An issue was discovered in FRRouting FRR 9.0

CVE-2023-41361 9.8 - Critical - August 29, 2023

An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large length of the rcv software version.

Classic Buffer Overflow

A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored

CVE-2023-3748 7.5 - High - July 24, 2023

A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages with the unicast flag set, the interval field set to 0, or any TLV that contains a sub-TLV with the Mandatory flag set to enter an infinite loop and cause a denial of service.

Infinite Loop

An issue found in Frrouting bgpd v.8.4.2

CVE-2023-31489 5.5 - Medium - May 09, 2023

An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_capability_llgr() function.

An issue found in Frrouting bgpd v.8.4.2

CVE-2023-31490 7.5 - High - May 09, 2023

An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function.

An issue was discovered in bgpd in FRRouting (FRR) through 8.4

CVE-2022-40302 6.5 - Medium - May 03, 2023

An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent boundary checks that do not account for reading 3 bytes (instead of 2) in this 0xff case.

Out-of-bounds Read

An issue was discovered in bgpd in FRRouting (FRR) through 8.4

CVE-2022-40318 6.5 - Medium - May 03, 2023

An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent boundary checks that do not account for reading 3 bytes (instead of 2) in this 0xff case. NOTE: this behavior occurs in bgp_open_option_parse in the bgp_open.c file, a different location (with a different attack vector) relative to CVE-2022-40302.

Out-of-bounds Read

An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4

CVE-2022-43681 6.5 - Medium - May 03, 2023

An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4. When sending a malformed BGP OPEN message that ends with the option length octet (or the option length word, in case of an extended OPEN message), the FRR code reads of out of the bounds of the packet, throwing a SIGABRT signal and exiting. This results in a bgpd daemon restart, causing a Denial-of-Service condition.

Out-of-bounds Read

A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek_for_as4_capability function

CVE-2022-36440 7.5 - High - April 03, 2023

A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek_for_as4_capability function. Attackers can maliciously construct BGP open packets and send them to BGP peers running frr-bgpd, resulting in DoS.

assertion failure

An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service

CVE-2022-37032 9.1 - Critical - September 19, 2022

An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c.

Out-of-bounds Read

An issue was discovered in bgpd in FRRouting (FRR) 8.3

CVE-2022-37035 8.1 - High - August 02, 2022

An issue was discovered in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c, there is a possible use-after-free due to a race condition. This could lead to Remote Code Execution or Information Disclosure by sending crafted BGP packets. User interaction is not needed for exploitation.

Race Condition

Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c.

CVE-2022-26125 7.8 - High - March 03, 2022

Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c.

Improper Validation of Specified Quantity in Input

Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c.

CVE-2022-26126 7.8 - High - March 03, 2022

Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c.

Buffer Overflow

A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in the babel_packet_examin function in babeld/message.c.

CVE-2022-26127 7.8 - High - March 03, 2022

A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in the babel_packet_examin function in babeld/message.c.

Improper Validation of Specified Quantity in Input

A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in the babel_packet_examin function in babeld/message.c.

CVE-2022-26128 7.8 - High - March 03, 2022

A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in the babel_packet_examin function in babeld/message.c.

Improper Validation of Specified Quantity in Input

Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the subtlv length in the functions

CVE-2022-26129 7.8 - High - March 03, 2022

Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the subtlv length in the functions, parse_hello_subtlv, parse_ihu_subtlv, and parse_update_subtlv in babeld/message.c.

Buffer Overflow

bgpd in FRRouting FRR (aka Free Range Routing) 2.x and 3.x before 3.0.4, 4.x before 4.0.1, 5.x before 5.0.2, and 6.x before 6.0.2 (not affecting Cumulus Linux or VyOS), when ENABLE_BGP_VNC is used for Virtual Network Control

CVE-2019-5892 6.5 - Medium - January 10, 2019

bgpd in FRRouting FRR (aka Free Range Routing) 2.x and 3.x before 3.0.4, 4.x before 4.0.1, 5.x before 5.0.2, and 6.x before 6.0.2 (not affecting Cumulus Linux or VyOS), when ENABLE_BGP_VNC is used for Virtual Network Control, allows remote attackers to cause a denial of service (peering session flap) via attribute 255 in a BGP UPDATE packet. This occurred during Disco in January 2019 because FRR does not implement RFC 7606, and therefore the packets with 255 were considered invalid VNC data and the BGP session was closed.

Interpretation Conflict