CVE-2023-41360

An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.

An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

Security Fix(es):

• frr: incorrect length check in bgp_capability_llgr() can lead do DoS (CVE-2023-31489)
• frr: missing length check in bgp_attr_psid_sub() can lead do DoS (CVE-2023-31490)
• frr: processes invalid NLRIs if attribute length is zero (CVE-2023-41358)
• frr: out of bounds read in bgp_attr_aigp_valid (CVE-2023-41359)
• frr: NULL pointer dereference in bgp_nlri_parse_flowspec() in bgpd/bgp_flowspec.c (CVE-2023-41909)
• frr: mishandled malformed data leading to a crash (CVE-2023-46752)
• frr: crafted BGP UPDATE message leading to a crash (CVE-2023-46753)
• frr: ahead-of-stream read of ORF header (CVE-2023-41360)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• SECURITY UPDATE: bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation
  • debian/patches/CVE-2023-41360.patch: don't read the first byte of ORF header if we are ahead of stream.
  • CVE-2023-41360
• SECURITY UPDATE: bgpd/bgp_packet.c processes NLRIs if the attribute length is zero
  • debian/patches/CVE-2023-41358.patch: do not process NLRIs if the attribute length is zero
  • CVE-2023-41358

• SECURITY UPDATE: bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation
  • debian/patches/CVE-2023-41360.patch: don't read the first byte of ORF header if we are ahead of stream.
  • CVE-2023-41360
• SECURITY UPDATE: bgpd/bgp_packet.c processes NLRIs if the attribute length is zero
  • debian/patches/CVE-2023-41358.patch: do not process NLRIs if the attribute length is zero
  • CVE-2023-41358
• Fix documentation pdf generation

• CVE-2023-41360: don't read the first byte of ORF header if we are ahead of stream
• CVE-2023-41358: do not process NLRIs if the attribute length is zero

• CVE-2023-41360: don't read the first byte of ORF header if we are ahead of stream
• CVE-2023-41358: do not process NLRIs if the attribute length is zero

These are all security issues fixed in the frr-8.4-5.1 package on the GA media of openSUSE Tumbleweed.

This update for frr fixes the following issues:

• CVE-2023-38802: Fixed bad length handling in BGP attribute handling (bsc#1213284).
• CVE-2023-41358: Fixed crash in bgpd/bgp_packet.c (bsc#1214735).
• CVE-2023-41360: Fixed out-of-bounds read in bgpd/bgp_packet.c (bsc#1214739).
• CVE-2023-3748: Fixed inifinite loop in babld message parsing may cause DoS (bsc#1213434).
• CVE-2023-41909: Fixed NULL pointer dereference due to processing in bgp_nlri_parse_flowspec (bsc#1215065).

This update for frr fixes the following issues:

Update to frr 8.5.6 (jsc#PED-PED-11092) including fixes for:

• CVE-2024-44070,CVE-2024-34088,CVE-2024-31951,CVE-2024-31950, CVE-2024-31948,CVE-2024-27913,CVE-2023-47235,CVE-2023-47234, CVE-2023-46753,CVE-2023-46752,CVE-2023-41909,CVE-2023-41360, CVE-2023-41358,CVE-2023-38802,CVE-2023-38407,CVE-2023-38406, CVE-2023-3748,CVE-2023-31490,CVE-2023-31489 and other bugfixes. See https://frrouting.org/release/8.5.6/ for details.

The most recent frr 8.x series provides several new features, improvements and bug fixes for various protocols and daemons, especially for PIM/PIMv6/BGP and VRF support.

See https://frrouting.org/release/8.5/ for details and links.

It was discovered that the Quagga BGP daemon did not properly check the attribute length in NRLI. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-41358)

It was discovered that the Quagga BGP daemon did not properly manage memory when reading initial bytes of ORF header. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-41360)

It was discovered that the FRR did not properly check the attribute length in NRLI. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-41358)

It was discovered that the FRR did not properly manage memory when reading initial bytes of ORF header. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-41360)

It was discovered that FRR did not properly validate the attributes in the BGP FlowSpec functionality. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-41909)