Vulnerability · Published Sep 13, 2026 · Assigned by mitre
CVE-2022-42917
Medium 6.7
In plain English
A medium-severity security flaw in FRRouting from FRRouting. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/etc/frr) and replacing config files upon creation with, for example, symlinks to change the ownership of arbitrary files. This is a TOCTOU Race Condition caused by a combination of touch and chown.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | frr | 8.4.1-1 | DEBIAN-CVE-2022-42917 |
| Debian:13 | frr | 8.4.1-1 | DEBIAN-CVE-2022-42917 |
| Debian:14 | frr | 8.4.1-1 | DEBIAN-CVE-2022-42917 |
| Ubuntu:22.04:LTS | frr | no fix listed | UBUNTU-CVE-2022-42917 |
Affected products (as reported)
Weakness: CWE-367 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H