Published: 03/05/2023 Updated: 16/02/2024

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 0

An out-of-bounds read exists in the BGP daemon of FRRouting FRR up to and including 8.4. When sending a malformed BGP OPEN message that ends with the option length octet (or the option length word, in case of an extended OPEN message), the FRR code reads of out of the bounds of the packet, throwing a SIGABRT signal and exiting. This results in a bgpd daemon restart, causing a Denial-of-Service condition.

Vulnerable Product	Search on Vulmon	Subscribe to Product
frrouting frrouting
debian debian linux 10.0
debian debian linux 11.0
debian debian linux 12.0

Synopsis Moderate: frr security and bug fix update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for frr is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as having ...

Debian Bug report logs - #1035829 frr: CVE-2022-43681 CVE-2022-40318 CVE-2022-40302 Package: src:frr; Maintainer for src:frr is David Lamparter <equinox-debian@diac24net>; Reported by: Moritz Mühlenhoff <jmm@inutilorg> Date: Tue, 9 May 2023 19:21:02 UTC Severity: grave Tags: security Reply or subscribe to t ...

Multiple vulnerabilities were discovered in frr, the FRRouting suite of internet protocols, while processing malformed requests and packets the BGP daemon may have reachable assertions, NULL pointer dereference, out-of-bounds memory access, which may lead to denial of service attack For the oldstable distribution (bullseye), these problems have be ...

A simple BGP fuzzer based on BooFuzz The goal of this project was to implement a simple black-box fuzzer for various BGP protocol implementations For the moment, the focus of the fuzzer is malformed packets, but we believe that it can be extended to cover some of the bugs related to the BGP state machine We chose to build upon BooFuzz Usage Before running the tool for the fi

CWE-125 https://forescout.com https://www.debian.org/security/2023/dsa-5495 https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html https://access.redhat.com/errata/RHSA-2023:6434 https://www.debian.org/security/2023/dsa-5495 https://nvd.nist.gov

CVE-2022-43681

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect