CVE-2022-43681: Medium severity frrouting bgpd vulnerability
An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4. When sending a malformed BGP OPEN message that ends with the option length octet (or the option length word, in case of an extended OPEN message), the FRR code reads of out of the bounds of the packet, throwing a SIGABRT signal and exiting. This results in a bgpd daemon restart, causing a Denial-of-Service condition.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-43681?
CVE-2022-43681 is a vulnerability in the BGP daemon of FRRouting FRR through version 8.4, which allows an out-of-bounds read when sending a malformed BGP OPEN message.
How does CVE-2022-43681 affect FRRouting?
CVE-2022-43681 affects FRRouting versions up to and including 8.4, allowing an attacker to trigger an out-of-bounds read by sending a specific type of malformed BGP OPEN message.
What is the severity of CVE-2022-43681?
The severity of CVE-2022-43681 is rated as medium with a severity value of 6.5.
How can I fix CVE-2022-43681 in FRRouting?
To fix CVE-2022-43681 in FRRouting, you should update to a version that is not affected by the vulnerability, such as version 8.4.4-1.1~deb12u1 or later.
Where can I find more information about CVE-2022-43681?
You can find more information about CVE-2022-43681 on the Forescout and Debian security tracker websites.