CVE-2023-46753

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an unknown transit attribute.

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

Security Fix(es):

• frr: missing length check in bgp_attr_psid_sub() can lead do DoS (CVE-2023-31490)

• frr: processes invalid NLRIs if attribute length is zero (CVE-2023-41358)

• frr: NULL pointer dereference in bgp_nlri_parse_flowspec() in bgpd/bgp_flowspec.c (CVE-2023-41909)

• frr: mishandled malformed data leading to a crash (CVE-2023-46752)

• frr: crafted BGP UPDATE message leading to a crash (CVE-2023-46753)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an unknown transit attribute.

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

Security Fix(es):

• frr: incorrect length check in bgp_capability_llgr() can lead do DoS (CVE-2023-31489)
• frr: missing length check in bgp_attr_psid_sub() can lead do DoS (CVE-2023-31490)
• frr: processes invalid NLRIs if attribute length is zero (CVE-2023-41358)
• frr: out of bounds read in bgp_attr_aigp_valid (CVE-2023-41359)
• frr: NULL pointer dereference in bgp_nlri_parse_flowspec() in bgpd/bgp_flowspec.c (CVE-2023-41909)
• frr: mishandled malformed data leading to a crash (CVE-2023-46752)
• frr: crafted BGP UPDATE message leading to a crash (CVE-2023-46753)
• frr: ahead-of-stream read of ORF header (CVE-2023-41360)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

Security Fix(es):

• frr: missing length check in bgp_attr_psid_sub() can lead do DoS (CVE-2023-31490)
• frr: processes invalid NLRIs if attribute length is zero (CVE-2023-41358)
• frr: NULL pointer dereference in bgp_nlri_parse_flowspec() in bgpd/bgp_flowspec.c (CVE-2023-41909)
• frr: mishandled malformed data leading to a crash (CVE-2023-46752)
• frr: crafted BGP UPDATE message leading to a crash (CVE-2023-46753)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2023-41358: fix crash when processing NLRIs with zero attribute length
• CVE-2023-47235: fix EOR handling to avoid unwanted processing of malformed attributes
• CVE-2023-46753: fix mandatory attributes check for UPDATE messages with unknown transit attributes
• CVE-2023-47234: fix handling NLRIs when MP_UNREACH_NLRI received without mandatory attributes

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an unknown transit attribute.

These are all security issues fixed in the frr-8.4-7.1 package on the GA media of openSUSE Tumbleweed.

This update for frr fixes the following issues:

• CVE-2023-46753: Fixed a crash caused from a crafted BGP UPDATE message. (bsc#1216626)
• CVE-2023-46752: Fixed a crash caused from a mishandled malformed MP_REACH_NLRI data. (bsc#1216627)

This update for frr fixes the following issues:

• CVE-2023-46752: Fixed denial of service caused by mishandling malformed MP_REACH_NLRI data (bsc#1216627).
• CVE-2023-46753: Fixed denial of service caused by crafted BGP UPDATE messages (bsc#1216626).

This update for frr fixes the following issues:

Update to frr 8.5.6 (jsc#PED-PED-11092) including fixes for:

• CVE-2024-44070,CVE-2024-34088,CVE-2024-31951,CVE-2024-31950, CVE-2024-31948,CVE-2024-27913,CVE-2023-47235,CVE-2023-47234, CVE-2023-46753,CVE-2023-46752,CVE-2023-41909,CVE-2023-41360, CVE-2023-41358,CVE-2023-38802,CVE-2023-38407,CVE-2023-38406, CVE-2023-3748,CVE-2023-31490,CVE-2023-31489 and other bugfixes. See https://frrouting.org/release/8.5.6/ for details.

The most recent frr 8.x series provides several new features, improvements and bug fixes for various protocols and daemons, especially for PIM/PIMv6/BGP and VRF support.

See https://frrouting.org/release/8.5/ for details and links.

It was discovered that FRR incorrectly handled certain malformed NLRI data. A remote attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2023-46752)

It was discovered that FRR incorrectly handled certain BGP UPDATE messages. A remote attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2023-46753)

It was discovered that Quagga incorrectly handled certain BGP messages. A remote attacker could possibly use this issue to cause Quagga to crash, resulting in a denial of service.

It was discovered that FRR incorrectly handled certain network traffic. A remote attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2022-26126, CVE-2022-26127, CVE-2022-26128, CVE-2022-26129, CVE-2022-37032, CVE-2022-37035, CVE-2023-31490, CVE-2023-38406, CVE-2023-38407, CVE-2023-46752, CVE-2023-46753, CVE-2023-47234, CVE-2023-47235, CVE-2024-31948)

Ben Cartwright-Cox discovered that FRR incorrectly handled certain network traffic. A remote attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2023-38802)