CVE-2024-31951
In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer...
In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).
- Record
CVE-2024-31951- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2024-29809
In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).
- Record
EUVD-2024-29809- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h4c3-x7vv-8q28
In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer...
In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).
- Record
GHSA-h4c3-x7vv-8q28- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
NVD
In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).
- Record
CVE-2024-31951- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSV
In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).
- Record
CVE-2024-31951- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-31951
In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).
- Record
DEBIAN-CVE-2024-31951- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2024-31951
In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).
- Record
UBUNTU-CVE-2024-31951- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-39815 No score
CVE-2024-31951 affecting package frr for versions less than 8.5.5-1
In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).
- Record
AZL-39815- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14038-1 No score
frr-8.4-12.1 on GA media
These are all security issues fixed in the frr-8.4-12.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14038-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1971-1 No score
Security update for frr
This update for frr fixes the following issues:
- CVE-2024-34088: Fixed null pointer via get_edge() function can trigger a denial of service (bsc#1223786).
- CVE-2024-31951: Fixed buffer overflow in ospf_te_parse_ext_link (bsc#1222528).
- CVE-2024-31950: Fixed buffer overflow and daemon crash in ospf_te_parse_ri (bsc#1222526).
- Record
SUSE-SU-2024:1971-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:4090-1 No score
Security update for frr
This update for frr fixes the following issues:
Update to frr 8.5.6 (jsc#PED-PED-11092) including fixes for:
- CVE-2024-44070,CVE-2024-34088,CVE-2024-31951,CVE-2024-31950, CVE-2024-31948,CVE-2024-27913,CVE-2023-47235,CVE-2023-47234, CVE-2023-46753,CVE-2023-46752,CVE-2023-41909,CVE-2023-41360, CVE-2023-41358,CVE-2023-38802,CVE-2023-38407,CVE-2023-38406, CVE-2023-3748,CVE-2023-31490,CVE-2023-31489 and other bugfixes. See https://frrouting.org/release/8.5.6/ for details.
The most recent frr 8.x series provides several new features, improvements and bug fixes for various protocols and daemons, especially for PIM/PIMv6/BGP and VRF support.
See https://frrouting.org/release/8.5/ for details and links.
- Record
SUSE-SU-2024:4090-1- Updated
- 2026-11-02
OSVUSN-6794-1 No score
frr vulnerabilities
It was discovered that FRR incorrectly handled certain malformed BGP and OSPF packets. A remote attacker could use this issue to cause FRR to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-6794-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
frrAzure Linux:2 |
before 8.5.5-1 | 8.5.5-1 |
frrDebian:12 |
before 8.4.4-1.1~deb12u2, plus listed versions 8.4.2-18.4.4-18.4.4-1.1~deb12u1 |
8.4.4-1.1~deb12u2 |
frrDebian:13 |
before 10.3-3+deb13u1, plus listed versions 10.3-3 |
10.3-3+deb13u1 |
frrDebian:14 |
before 10.0.1-0.1 | 10.0.1-0.1 |
frrSUSE:Linux Enterprise Module for Server Applications 15 SP5 From an advisory covering 3 CVEs |
before 8.4-150500.4.23.1 | 8.4-150500.4.23.1 |
frrSUSE:Linux Enterprise Module for Server Applications 15 SP6 From an advisory covering 3 CVEs |
before 8.4-150500.4.23.1 | 8.4-150500.4.23.1 |
frropenSUSE:Leap 15.5 From an advisory covering 3 CVEs |
before 8.4-150500.4.23.1 | 8.4-150500.4.23.1 |
frropenSUSE:Leap 15.6 From an advisory covering 3 CVEs |
before 8.4-150500.4.23.1 | 8.4-150500.4.23.1 |
frrSUSE:Linux Enterprise Module for Server Applications 15 SP5 From an advisory covering 19 CVEs |
before 8.5.6-150500.4.30.1 | 8.5.6-150500.4.30.1 |
frrSUSE:Linux Enterprise Module for Server Applications 15 SP6 From an advisory covering 19 CVEs |
before 8.5.6-150500.4.30.1 | 8.5.6-150500.4.30.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
frropenSUSE:Leap 15.5 From an advisory covering 19 CVEs |
before 8.5.6-150500.4.30.1 | 8.5.6-150500.4.30.1 |
frropenSUSE:Leap 15.6 From an advisory covering 19 CVEs |
before 8.5.6-150500.4.30.1 | 8.5.6-150500.4.30.1 |
frrUbuntu:22.04:LTS |
before 8.1-1ubuntu1.10, plus listed versions 7.5.1-1.18.1-18.1-1ubuntu18.1-1ubuntu1.18.1-1ubuntu1.2 Show 7 moreShow less8.1-1ubuntu1.38.1-1ubuntu1.48.1-1ubuntu1.58.1-1ubuntu1.68.1-1ubuntu1.78.1-1ubuntu1.88.1-1ubuntu1.9 |
8.1-1ubuntu1.10 |
frrUbuntu:24.04:LTS |
before 8.4.4-1.1ubuntu6.1, plus listed versions 8.4.4-1.1ubuntu18.4.4-1.1ubuntu38.4.4-1.1ubuntu48.4.4-1.1ubuntu58.4.4-1.1ubuntu6 |
8.4.4-1.1ubuntu6.1 |
frrUbuntu:22.04:LTS From an advisory covering 4 CVEs |
before 8.1-1ubuntu1.10, plus listed versions 7.5.1-1.18.1-18.1-1ubuntu18.1-1ubuntu1.18.1-1ubuntu1.2 Show 7 moreShow less8.1-1ubuntu1.38.1-1ubuntu1.48.1-1ubuntu1.58.1-1ubuntu1.68.1-1ubuntu1.78.1-1ubuntu1.88.1-1ubuntu1.9 |
8.1-1ubuntu1.10 |
frrUbuntu:24.04:LTS From an advisory covering 4 CVEs |
before 8.4.4-1.1ubuntu6.1, plus listed versions 8.4.4-1.1ubuntu18.4.4-1.1ubuntu38.4.4-1.1ubuntu48.4.4-1.1ubuntu58.4.4-1.1ubuntu6 |
8.4.4-1.1ubuntu6.1 |
frropenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 8.4-12.1 | 8.4-12.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-31951 is a medium vulnerability (CVSS 6.5) in Frrouting, published April 7, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in frr 8.5.5-1.
References
github.com/FRRouting/frr/pull/15674
nvd.nist.gov/vuln/detail/CVE-2024-31951
security-tracker.debian.org/tracker/CVE-2024-31951
Show 30 moreShow less
suse.com/support/update/announcement/2024/suse-su-20241971-1
bugzilla.suse.com/1222526
ubuntu.com/security/CVE-2024-31951
cve.org/CVERecord?id=CVE-2024-31951