Vulnerability · Published May 3, 2023 · Assigned by mitre
CVE-2022-40318
Medium 6.5
In plain English
A medium-severity security flaw in the frr package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent boundary checks that do not account for reading 3 bytes (instead of 2) in this 0xff case. NOTE: this behavior occurs in bgp_open_option_parse in the bgp_open.c file, a different location (with a different attack vector) relative to CVE-2022-40302.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | frr | 8.3.1-11.el9_3.alma.1 | ALSA-2023:6434 |
| AlmaLinux:9 | frr-selinux | 8.3.1-11.el9_3.alma.1 | ALSA-2023:6434 |
| Debian:12 | frr | 8.4.1-1 | DEBIAN-CVE-2022-40318 |
| Debian:13 | frr | 8.4.1-1 | DEBIAN-CVE-2022-40318 |
| Debian:14 | frr | 8.4.1-1 | DEBIAN-CVE-2022-40318 |
| Ubuntu:22.04:LTS | frr | 8.1-1ubuntu1.3 | UBUNTU-CVE-2022-40318 |