Published: 02/08/2022 Updated: 28/04/2024

CVSS v3 Base Score: 8.1 | Impact Score: 5.9 | Exploitability Score: 2.2

VMScore: 0

An issue exists in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c, there is a possible use-after-free due to a race condition. This could lead to Remote Code Execution or Information Disclosure by sending crafted BGP packets. User interaction is not needed for exploitation.

Vulnerable Product	Search on Vulmon	Subscribe to Product
frrouting frrouting 8.3

Debian Bug report logs - #1016978 frr: CVE-2022-37035 Package: src:frr; Maintainer for src:frr is David Lamparter <equinox-debian@diac24net>; Reported by: Moritz Mühlenhoff <jmm@inutilorg> Date: Wed, 10 Aug 2022 20:15:07 UTC Severity: grave Tags: security, upstream Forwarded to githubcom/FRRouting/frr ...

Several security issues were fixed in FRR ...

An issue was discovered in bgpd in FRRouting (FRR) 83 In bgp_notify_send_with_data() and bgp_process_packet() in bgp_packetc, there is a possible use-after-free due to a race condition This could lead to Remote Code Execution or Information Disclosure by sending crafted BGP packets User interaction is not needed for exploitation ...

CWE-362 https://docs.google.com/document/d/1TqYEcZbFeDTMKe2N4XRFwyAjw_mynIHfvzwbx1fmJj8/edit?usp=sharing https://github.com/FRRouting/frr/issues/11698 https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1016978 https://ubuntu.com/security/notices/USN-5685-1 https://nvd.nist.gov

CVE-2022-37035

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect