← Back to CVE Index
CVE-2024-27913
Disclosed 2024-02-28
Description
ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash) via a malformed OSPF LSA packet, because of an attempted access to a missing attribute field.
Severity & CVSS Score
6.2
HIGH
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
| CWE-ID | Name |
|---|---|
| CWE-909 | Missing Initialization of Resource |
Affected FRR Versions
- 8.4.0 ~ 8.4.4
- 8.5.0 ~ 8.5.4
- 9.0.0 ~ 9.0.2
- 9.1.0
- 10.0.0
Versions prior to 8.4 are end-of-life and no longer receive security updates.
References
| URL | Source |
|---|---|
| https://github.com/FRRouting/frr/pull/15431/commits/a73e66d07329d721f26f3f336f7735de420b0183 | GitHub |
Git Fixes
- a73e66d07329d721f26f3f336f7735de420b0183
- 9bc006048711226c1484de04738487ce9bbcfd0c
- aae54e20498974cb026bd0e2649ca3e753090492
- 34ec60582880c7697981582f53eb8d7bd6e7f02b
Raw Data
- CVE-2024-27913.cve.json — CVE record (JSON)
- CVE-2024-27913.frr.json — FRR-specific data (JSON)