CVE-2023-41909

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

Security Fix(es):

• frr: missing length check in bgp_attr_psid_sub() can lead do DoS (CVE-2023-31490)

• frr: processes invalid NLRIs if attribute length is zero (CVE-2023-41358)

• frr: NULL pointer dereference in bgp_nlri_parse_flowspec() in bgpd/bgp_flowspec.c (CVE-2023-41909)

• frr: mishandled malformed data leading to a crash (CVE-2023-46752)

• frr: crafted BGP UPDATE message leading to a crash (CVE-2023-46753)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference.

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

Security Fix(es):

• frr: incorrect length check in bgp_capability_llgr() can lead do DoS (CVE-2023-31489)
• frr: missing length check in bgp_attr_psid_sub() can lead do DoS (CVE-2023-31490)
• frr: processes invalid NLRIs if attribute length is zero (CVE-2023-41358)
• frr: out of bounds read in bgp_attr_aigp_valid (CVE-2023-41359)
• frr: NULL pointer dereference in bgp_nlri_parse_flowspec() in bgpd/bgp_flowspec.c (CVE-2023-41909)
• frr: mishandled malformed data leading to a crash (CVE-2023-46752)
• frr: crafted BGP UPDATE message leading to a crash (CVE-2023-46753)
• frr: ahead-of-stream read of ORF header (CVE-2023-41360)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

Security Fix(es):

• frr: missing length check in bgp_attr_psid_sub() can lead do DoS (CVE-2023-31490)
• frr: processes invalid NLRIs if attribute length is zero (CVE-2023-41358)
• frr: NULL pointer dereference in bgp_nlri_parse_flowspec() in bgpd/bgp_flowspec.c (CVE-2023-41909)
• frr: mishandled malformed data leading to a crash (CVE-2023-46752)
• frr: crafted BGP UPDATE message leading to a crash (CVE-2023-46753)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2022-36440: fix heap-buffer-overflow in peek_for_as4_capability when reading BGP OPEN extended optional parameters
• CVE-2023-31490: fix insufficient stream data validation in BGP prefix SID attributes processing
• CVE-2023-38407: fix out-of-bounds read in BGP labeled unicast parsing
• CVE-2023-41909: fix implicit withdrawal handling for BGP flowspec without attributes

An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference.

These are all security issues fixed in the frr-8.4-6.1 package on the GA media of openSUSE Tumbleweed.

This update for frr fixes the following issues:

• CVE-2023-38802: Fixed bad length handling in BGP attribute handling (bsc#1213284).
• CVE-2023-41358: Fixed crash in bgpd/bgp_packet.c (bsc#1214735).
• CVE-2023-41360: Fixed out-of-bounds read in bgpd/bgp_packet.c (bsc#1214739).
• CVE-2023-3748: Fixed inifinite loop in babld message parsing may cause DoS (bsc#1213434).
• CVE-2023-41909: Fixed NULL pointer dereference due to processing in bgp_nlri_parse_flowspec (bsc#1215065).

This update for frr fixes the following issues:

• CVE-2023-38802: Fixed bad length handling when processing BGP attributes. (bsc#1213284)
• CVE-2023-41358: Fixed a possible crash when processing NLRIs with an attribute length of zero. (bsc#1214735)
• CVE-2023-41909: Fixed NULL pointer dereference due to processing in bgp_nlri_parse_flowspec (bsc#1215065).

This update for frr fixes the following issues:

Update to frr 8.5.6 (jsc#PED-PED-11092) including fixes for:

• CVE-2024-44070,CVE-2024-34088,CVE-2024-31951,CVE-2024-31950, CVE-2024-31948,CVE-2024-27913,CVE-2023-47235,CVE-2023-47234, CVE-2023-46753,CVE-2023-46752,CVE-2023-41909,CVE-2023-41360, CVE-2023-41358,CVE-2023-38802,CVE-2023-38407,CVE-2023-38406, CVE-2023-3748,CVE-2023-31490,CVE-2023-31489 and other bugfixes. See https://frrouting.org/release/8.5.6/ for details.

The most recent frr 8.x series provides several new features, improvements and bug fixes for various protocols and daemons, especially for PIM/PIMv6/BGP and VRF support.

See https://frrouting.org/release/8.5/ for details and links.

It was discovered that the FRR did not properly check the attribute length in NRLI. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-41358)

It was discovered that the FRR did not properly manage memory when reading initial bytes of ORF header. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-41360)

It was discovered that FRR did not properly validate the attributes in the BGP FlowSpec functionality. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-41909)