← Back to CVE Index

CVE-2024-31948

Disclosed 2024-04-07

Description

In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crash.

Severity & CVSS Score

6.5 HIGH CVSS 3.1
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness Enumeration

CWE-IDName
CWE-1287 Improper Validation of Specified Type of Input

Affected FRR Versions

  • 8.4.0 ~ 8.4.4
  • 8.5.0 ~ 8.5.4
  • 9.0.0 ~ 9.0.2
  • 9.1.0
  • 10.0.0

Versions prior to 8.4 are end-of-life and no longer receive security updates.

References

URLSource
https://github.com/FRRouting/frr/pull/15628/commits/ba6a8f1a31e1a88df2de69ea46068e8bd9b97138 GitHub

Git Fixes

Raw Data