PT-2024-6033 · Frrouting+2 · Frrouting+2

Iggy Frankovic · Published 2024-04-07 · Updated 2025-05-01 · CVE-2024-31949

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FRRouting versions through 9.1

Description The issue is related to the Dynamic Capability Handler component in FRRouting, which can lead to an infinite loop when receiving a MP/GR capability as a dynamic capability due to malformed data causing a pointer not to advance. This can allow a remote attacker to cause a denial of service.

Recommendations For versions through 9.1, consider disabling the Dynamic Capability Handler component as a temporary workaround until a patch is available. Restrict access to the MP/GR capability to minimize the risk of exploitation. Avoid using malformed data in the dynamic capability to prevent the infinite loop.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2024-06851

CVE-2024-31949

DLA-3797-1

DLA-3865-1

Affected Products

Debian

Frrouting

Red Os

References · 20

• https://github.com/FRRouting/frr/pull/15640/commits/30a332dad86fafd2b0b6c61d23de59ed969a219b · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-31949 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-31949 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3865-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06851 · Security Note
• https://osv.dev/vulnerability/DLA-3797-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-31949 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31949 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31949 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-31949 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-31949 · Vendor Advisory
• https://github.com/FRRouting/frr/pull/15640 · Note
• https://t.me/cvenotify/75979 · Telegram Post
• https://redos.red-soft.ru/support/secure · Note
• https://t.me/cvenotify/120502 · Telegram Post