CVE-2024-44070: Critical severity Frrouting FRRouting vulnerability
Published Aug 19, 2024
·Updated
An issue was discovered in FRRouting (FRR) through 10.1. bgpattrencap in bgpd/bgpattr.c does not check the actual remaining stream length before taking the TLV value.
Affected Software
7 affected componentsFixes available
Frrouting FRRouting<=10.1
redhat Enterprise Linux=8.0
redhat Enterprise Linux=9.0
debian/frr<=7.5.1-1.1+deb11u2, <=8.4.4-1.1~deb12u1
7.5.1-1.1+deb11u410.2.1-610.3-1
Microsoft cbl2 frr 8.5.5-1
Microsoft cbl2 frr 8.5.5-2
Microsoft azl3 frr 9.1.1-2
Remediation
Patch Available
Event History
Aug 19, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·02:15 AM
RemedyDescriptionSeverityAffected Software
Sep 11, 2024
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
SeverityAffected Software
Updated
via Microsoft·07:00 AM
DescriptionSeverity
Feb 1, 2025
Data Sourced
via Ubuntu·12:03 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-44070?
CVE-2024-44070 is classified as a medium severity vulnerability due to improper length checks in FRRouting.
2
How do I fix CVE-2024-44070?
To remediate CVE-2024-44070, update FRRouting to version 10.2.1-2 or later.
3
Which systems are affected by CVE-2024-44070?
CVE-2024-44070 affects FRRouting versions up to 10.1 and specific versions of Red Hat Enterprise Linux 8.0 and 9.0.
4
Is CVE-2024-44070 exploitable remotely?
Yes, CVE-2024-44070 may be exploitable remotely depending on the network configuration.
5
What application is impacted by CVE-2024-44070?
CVE-2024-44070 impacts the FRRouting application, specifically its bgpd component.