CVE-2024-31948: Medium severity Frrouting FRRouting vulnerability
In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/frrto a version that resolves this vulnerability.Fixed in 10.0.1-0.1 - Upgrade
Upgrade
debian/frrto a version that resolves this vulnerability.Fixed in 10.3-3+deb13u1Fixed in 10.7.1-6
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31948?
CVE-2024-31948 has a severity rating that may lead to a denial of service by crashing the bgpd daemon.
How do I fix CVE-2024-31948?
To fix CVE-2024-31948, upgrade to the fixed versions of the FRRouting package, specifically 7.5.1-1.1+deb11u4 or 10.2.1-2.
Which software is affected by CVE-2024-31948?
CVE-2024-31948 affects the FRRouting (FRR) versions up to 9.1 on Debian systems.
What types of attacks can exploit CVE-2024-31948?
CVE-2024-31948 can be exploited through malformed Prefix SID attributes in BGP UPDATE packets.
What components are impacted by CVE-2024-31948?
The bgpd daemon in FRRouting is the component impacted by CVE-2024-31948, leading to potential crashes.