PT-2022-6596 · Frrouting+4 · Frrouting+4

Published 2022-11-21 · Updated 2024-04-03 · CVE-2022-40318

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FRRouting versions through 8.4

Description An issue in the bgpd component of FRRouting allows attackers to cause a denial of service by crafting a BGP OPEN message with an option of type 0xff. This is due to inconsistent boundary checks in the bgp open option parse function, located in the bgp open.c file, which fails to account for reading 3 bytes instead of 2 in this specific case. The exploitation of this issue can lead to an out-of-bounds read or an assertion failure and daemon restart.

Recommendations For FRRouting versions through 8.4, consider disabling the bgp open option parse function as a temporary workaround until a patch is available. Restrict access to the bgpd daemon to minimize the risk of exploitation. Avoid processing BGP OPEN messages with the option type 0xff until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2023:6434

ALT-PU-2023-1111

BDU:2023-02672

CVE-2022-40318

DLA-3573-1

DSA-5495-1

RHSA-2023:6434

RHSA-2023_6434

Affected Products

Alt Linux

Almalinux

Frrouting

Red Hat

Red Os

References · 34

• 🔥 https://github.com/spwpun/CVE-2022-37032 · Exploit
• 🔥 https://github.com/spwpun/pocs/blob/main/frr-bgpd.md · Exploit
• https://errata.almalinux.org/9/ALSA-2023-6434.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02672 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40318 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3573-1 · Vendor Advisory
• https://debian.org/security/2023/dsa-5495 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5495-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-40318 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-40318 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-40318 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-40318 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-40318 · Security Note
• https://linux.oracle.com/errata/ELSA-2023-6434.html · Vendor Advisory