CVE-2022-37032: Critical severity Frrouting FRRouting vulnerability
An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgpcapabilitymsgparse in bgpd/bgppacket.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/frrto a version that resolves this vulnerability.Fixed in 8.4.1-1 - Upgrade
Upgrade
debian/frrto a version that resolves this vulnerability.Fixed in 8.4.4-1.1~deb12u2Fixed in 10.3-3+deb13u1Fixed in 10.7.1-7 - Upgrade
Upgrade
FRRouting FRRto a version that resolves this vulnerability.Fixed in 8.4
Event History
Frequently Asked Questions
What is CVE-2022-37032?
CVE-2022-37032 is an out-of-bounds read vulnerability in the BGP daemon of FRRouting FRR before version 8.4.
How does CVE-2022-37032 impact FRRouting and Debian Linux?
CVE-2022-37032 may lead to a segmentation fault and denial of service in FRRouting versions before 8.4 and affects Debian Linux versions 10.0 and 11.0.
What is the severity of CVE-2022-37032?
CVE-2022-37032 has a severity rating of 9.1 (critical).
How can I fix CVE-2022-37032 in FRRouting?
To fix CVE-2022-37032 in FRRouting, upgrade to version 8.4 or later.
How can I fix CVE-2022-37032 in Debian Linux?
To fix CVE-2022-37032 in Debian Linux, update the frr package to one of the following versions: 7.5.1-1.1+deb10u1, 7.5.1-1.1+deb11u2, 8.4.4-1.1~deb12u1, or 8.4.4-1.1.