Out-of-Bounds Read in FRRouting Affects BGP Attributes
CVE-2023-41359

9.1CRITICAL

Key Information:

Vendor

Frrouting

Status
Frrouting
Vendor
CVE Published:
29 August 2023

What is CVE-2023-41359?

A vulnerability has been identified in FRRouting, specifically in the bgp_attr_aigp_valid function of bgpd/bgp_attr.c. This issue arises due to a lack of checks for two bytes' availability during AIGP validation. Consequently, this oversight could lead to unexpected behavior, potentially compromising network stability and reliability. Users of FRRouting should apply necessary updates to mitigate risks associated with this vulnerability.

References

https://github.com/FRRouting/frr/pull/14232
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisory

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.