CVE-2018-5379: Double Free
Last updated 25 August 2025
Other sources
The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code.
— Launchpad
The Quagga BGP daemon, bgpd, can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes.
This issue can be triggered by an optional/transitive UPDATE attribute, that all conforming eBGP speakers should pass along. This means this may triggerable in many affected Quagga bgpd processes across a wide area of a network, because of just one UPDATE message.
This issue could result in a crash of bgpd, or even allow a remote attacker to gain control of an affected bgpd process.
All versions are likely affected.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/quaggato a version that resolves this vulnerability.Fixed in 1.2.3 - Upgrade
Upgrade
Quagga BGP daemon (bgpd)to a version that resolves this vulnerability.Fixed in 1.2.3 - Compensating control
Mitigate by filtering/dropping malformed BGP UPDATE messages that include cluster-list and/or unknown optional/transitive attributes at network eBGP speaker boundaries (since the triggering UPDATE attribute is optional/transitive and should be passed along by conforming eBGP speakers).
Event History
Frequently Asked Questions
What is CVE-2018-5379?
CVE-2018-5379 is a vulnerability that exists in the Quagga BGP daemon (bgpd) prior to version 1.2.3.
What is the severity of CVE-2018-5379?
The severity of CVE-2018-5379 is critical with a CVSS score of 9.8.
How does CVE-2018-5379 impact affected software?
CVE-2018-5379 can cause a denial of service or potentially allow an attacker to execute arbitrary code.
Which software versions are affected by CVE-2018-5379?
Versions prior to 1.2.3 of the Quagga BGP daemon (bgpd) are affected by CVE-2018-5379.
How can CVE-2018-5379 be fixed?
To fix CVE-2018-5379, update the Quagga BGP daemon (bgpd) to version 1.2.3 or later.