Denial of Service Vulnerability in FRRouting Package
Summary
DEBIAN-CVE-2023-3748: A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. Affects frr versions < 9.1-0.1. Fixed in 9.1-0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FRRouting (FRR) is a robust routing protocol suite that provides a variety of routing protocols for both IPv4 and IPv6 networks. It is widely used in production environments for its flexibility and performance. However, like any software, it can be susceptible to vulnerabilities that may compromise its stability and security. This particular vulnerability affects FRRouting versions in Debian 13 and 14, specifically when handling certain babeld unicast hello messages.
Vulnerability Detail
A flaw was identified in FRRouting that occurs during the parsing of specific babeld unicast hello messages, which are meant to be ignored. An attacker could exploit this vulnerability by sending specially crafted hello messages with the unicast flag activated, a zero interval field, or any TLV containing a sub-TLV with the Mandatory flag. This could lead to an infinite loop within the software, resulting in a denial of service condition, where the affected service becomes unresponsive.
How To Fix
Minimum fixed version
9.1-0.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade frrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can implement network controls to filter out unicast hello messages that may exploit this vulnerability. This can be done by configuring firewalls or routers to block such messages until the package is updated.
Conclusion
The identified vulnerability in the FRRouting package poses a significant risk of denial of service due to improper handling of babeld unicast hello messages. It is crucial for users to update to the patched version to mitigate this risk. Implementing temporary workarounds can help maintain service availability until the update is applied.
See every vulnerability recorded for frr →
FAQ
The vulnerability allows an attacker to send specially crafted hello messages that can cause the software to enter an infinite loop, leading to a denial of service.
The vulnerability affects FRRouting versions prior to 9.1-0.1 in both Debian 13 and 14.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If immediate updates are not possible, consider implementing network controls to filter out potentially harmful hello messages until the patch can be applied.
Detailed information about this vulnerability can be found in the Debian CVE database or by visiting the Vulert website for real-time monitoring of open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for frr.
