Use-After-Free Vulnerability in BGP Implementation of FRRouting Software
CVE-2022-37035

8.1HIGH

Key Information:

Vendor

Frrouting

Status
Frrouting
Vendor
CVE Published:
2 August 2022

What is CVE-2022-37035?

An issue has been identified in the BGP implementation of FRRouting version 8.3, where a use-after-free condition can occur due to a race condition within the bgp_notify_send_with_data() and bgp_process_packet() functions in bgp_packet.c. This vulnerability allows an attacker to craft malicious BGP packets that could potentially lead to Remote Code Execution or Information Disclosure. Notably, the exploitation of this vulnerability does not require any user interaction, increasing the risk associated with it.

References

https://docs.google.com/document/d/1TqYEcZbFeDTMKe2N4XRFw...
https://github.com/FRRouting/frr/issues/11698
https://lists.debian.org/debian-lts-announce/2024/04/msg0...
mailing-list

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.