PT-2022-6597 · Unknown+4 · Frrouting Frr+4

Published 2022-10-24 · Updated 2024-04-03 · CVE-2022-43681

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FRRouting FRR versions through 8.4

Description An out-of-bounds read exists in the BGP daemon of FRRouting FRR. When sending a malformed BGP OPEN message that ends with the option length octet (or the option length word, in case of an extended OPEN message), the FRR code reads out of the bounds of the packet, throwing a SIGABRT signal and exiting. This results in a bgpd daemon restart, causing a Denial-of-Service condition. The issue can be exploited by a remote attacker to cause a denial of service.

Recommendations For FRRouting FRR versions through 8.4, consider disabling the BGP daemon until a patch is available to prevent exploitation. Restrict access to the BGP daemon to minimize the risk of exploitation. Avoid sending malformed BGP OPEN messages to the affected system until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2023:6434

ALT-PU-2023-1111

BDU:2023-02673

CVE-2022-43681

DLA-3573-1

DSA-5495-1

RHSA-2023:6434

RHSA-2023_6434

Affected Products

Alt Linux

Almalinux

Frrouting Frr

Red Hat

Red Os

References · 36

• 🔥 https://github.com/spwpun/CVE-2022-37032 · Exploit
• 🔥 https://github.com/spwpun/pocs/blob/main/frr-bgpd.md · Exploit
• https://errata.almalinux.org/9/ALSA-2023-6434.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-43681 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-43681 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43681 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-43681 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43681 · Vendor Advisory
• https://debian.org/security/2023/dsa-5495 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3573-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5495-1 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02673 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-43681 · Security Note
• https://linux.oracle.com/errata/ELSA-2023-6434.html · Vendor Advisory