CVE-2023-41909: Null Pointer Dereference
Published Sep 5, 2023
·Updated
An issue was discovered in FRRouting FRR through 9.0. bgpnlriparseflowspec in bgpd/bgpflowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference.
Affected Software
11 affected componentsFixes available
debian/frr<=6.0.2-2+deb10u1, <=7.5.1-1.1+deb11u2
7.5.1-1.1+deb10u18.4.4-1.1~deb12u19.1-0.1
ubuntu/frr<7.2.1-1ubuntu0.2+
7.2.1-1ubuntu0.2+
ubuntu/frr<8.1-1ubuntu1.6
8.1-1ubuntu1.6
ubuntu/frr<8.4.2-1ubuntu1.4
8.4.2-1ubuntu1.4
ubuntu/frr<8.4.4-1
8.4.4-1
redhat/frr<9.0
9.0
Frrouting FRRouting<=9.0
Debian Debian Linux=10.0
Fedoraproject Fedora=37
Fedoraproject Fedora=38
Fedoraproject Fedora=39
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/frrto a version that resolves this vulnerability.Fixed in 7.5.1-1.1+deb10u1Fixed in 8.4.4-1.1~deb12u1Fixed in 9.1-0.1 - Upgrade
Upgrade
ubuntu/frrto a version that resolves this vulnerability.Fixed in 7.2.1-1ubuntu0.2+ - Upgrade
Upgrade
ubuntu/frrto a version that resolves this vulnerability.Fixed in 8.1-1ubuntu1.6 - Upgrade
Upgrade
ubuntu/frrto a version that resolves this vulnerability.Fixed in 8.4.2-1ubuntu1.4 - Upgrade
Upgrade
ubuntu/frrto a version that resolves this vulnerability.Fixed in 8.4.4-1 - Upgrade
Upgrade
redhat/frrto a version that resolves this vulnerability.Fixed in 9.0 - Upgrade
Upgrade
FRRouting FRRto a version that resolves this vulnerability.Patch cfd04dcb3e689754a72507d086ba3b9709fc5ed8
Event History
Sep 5, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·07:15 AM
RemedyDescriptionSeverityWeaknessAffected Software