CVE-2022-26125: Buffer Overflow
Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isistlvs.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/frrto a version that resolves this vulnerability.Fixed in 8.4.4-1.1~deb12u2Fixed in 10.3-3+deb13u1Fixed in 10.7.1-6 - Upgrade
Upgrade
alpine/frrto a version that resolves this vulnerability.Fixed in 8.2.1-r0 - Upgrade
Upgrade
debian/frrto a version that resolves this vulnerability.Fixed in 8.4.1-1 - Upgrade
Upgrade
redhat/frroutingto a version that resolves this vulnerability.Fixed in 8.2
Event History
Frequently Asked Questions
What is CVE-2022-26125?
CVE-2022-26125 is a vulnerability in FRRouting that allows buffer overflow due to incorrect input packet length checks.
What is the severity of CVE-2022-26125?
CVE-2022-26125 has a severity rating of 7.8 (high).
How does CVE-2022-26125 impact FRRouting?
CVE-2022-26125 can lead to buffer overflow vulnerabilities in FRRouting versions up to 8.1.0.
Is there a fix available for CVE-2022-26125?
Yes, a fix is available for CVE-2022-26125 in FRRouting version 8.4.4-1.1~deb12u1 and later.
Where can I find more information about CVE-2022-26125?
You can find more information about CVE-2022-26125 on the GitHub issue (https://github.com/FRRouting/frr/issues/10507) and the Debian security tracker (https://security-tracker.debian.org/tracker/CVE-2022-26125).