Debian Patches

Status for frr/8.4.4-1.1~deb12u2

Patch Description Author Forwarded Bugs Origin Last update
CVE-2026-37457.patch fix off-by-one out-of-bounds write in FlowSpec operator array An off-by-one error in the FlowSpec operator decoding (bgp_flowspec_op_decode /
bgp_flowspec_bitmask_decode) allows a crafted FlowSpec NLRI with more than the
maximum number of chained operators to write one element past the mval[] array,
leading to a stack out-of-bounds write (CVE-2026-37457).
===================================================================		 not-needed upstream backport, https://github.com/FRRouting/frr/commit/0e6882bc72c0278988a47b2f0f73b7a91099a25c
CVE-2023-3748.patch babeld: avoid infinite loops in parse_packet A crafted babel packet (unicast Hello, interval==0, or a mandatory unknown
sub-TLV) could make parse_packet() in babeld/message.c loop forever because a
"continue" failed to advance the buffer index, causing a denial of service
(CVE-2023-3748).
diff --git a/babeld/message.c b/babeld/message.c
index 687f768446..b5c2a58984 100644		 not-needed upstream backport, https://github.com/FRRouting/frr/commit/ae1e0e1fed77716bc06f181ad68c4433fb5523d0
CVE-2024-27913.patch ospfd: fix crash in OSPF TE parsing of malformed LSA A malformed OSPF Traffic Engineering LSA could make ospf_te_parse_te() access a
missing attribute field and crash ospfd (CVE-2024-27913).
diff --git a/ospfd/ospf_te.c b/ospfd/ospf_te.c
index a55a37a907..359dc1f5d4 100644		 not-needed upstream backport, https://github.com/FRRouting/frr/commit/a73e66d07329d721f26f3f336f7735de420b0183
CVE-2024-31950.patch ospfd: fix buffer overflow in Router Information parsing ospf_te_parse_ri() in ospfd/ospf_te.c did not validate Segment Routing sub-TLV
lengths, allowing a crafted Router Information LSA to overflow a buffer and
crash ospfd (CVE-2024-31950).
diff --git a/ospfd/ospf_te.c b/ospfd/ospf_te.c
index 359dc1f5d4..091669d8ed 100644		 not-needed upstream backport, https://github.com/FRRouting/frr/commit/f69d1313b19047d3d83fc2b36a518355b861dfc4
CVE-2024-31951.patch ospfd: validate Extended Link sub-TLV lengths ospf_te_parse_ext_link() in ospfd/ospf_te.c did not validate Adjacency-SID
sub-TLV lengths, allowing a crafted Extended Link Opaque LSA to overflow a
buffer and crash ospfd (CVE-2024-31951).
diff --git a/ospfd/ospf_te.c b/ospfd/ospf_te.c
index 091669d8ed..e68f9444f5 100644		 not-needed upstream backport, https://github.com/FRRouting/frr/commit/5557a289acdaeec8cc63ffc97b5c2abf6dee7b3a
CVE-2024-34088.patch ospfd: protect calls to get_edge() against NULL get_edge() in ospfd/ospf_te.c may return NULL, but several callers
(ospf_te_update_link, ospf_te_parse_te, ospf_te_parse_ext_link) dereferenced
the result without checking, so a crafted OSPF TE LSA could crash ospfd
(CVE-2024-34088). Also reject invalid Link/Node IDs inside get_edge().
diff --git a/ospfd/ospf_te.c b/ospfd/ospf_te.c
index 23a1b181ec..d1f114e30a 100644		 not-needed upstream backport, https://github.com/FRRouting/frr/commit/cef38442420aeac8e163f8aa55f1b985908f993c
CVE-2026-37458.patch validate MP_REACH_NLRI attribute against incorrect next-hop The IPv4 next-hop carried in an MP_REACH_NLRI attribute was not validated, so
a martian next-hop was accepted and could cause a denial of service. Reject the
attribute (treat-as-withdraw) when the next-hop is a martian address, unless
the operator explicitly allowed martian next-hops (CVE-2026-37458).
===================================================================		 not-needed upstream backport, https://github.com/FRRouting/frr/commit/8102a8aeceb9f86fdfe1f80cd77080522bab69c8
CVE-2025-61104.patch ospfd: add NULL check for vty_out in check_tlv_size Companion to CVE-2025-61099.patch: guard the vty_out() call in check_tlv_size()
in ospf_ext.c so the OSPF Opaque LSA detail dump path does not dereference a
NULL vty (CVE-2025-61104).
===================================================================		 not-needed upstream backport, https://github.com/FRRouting/frr/commit/b7d9b7aa47627b31e4b50795284408ab6de98660
CVE-2023-41360.patch bgpd: Don't read the first byte of ORF header if we are ahead of stream

(cherry picked from commit 9b855a692e68e0d16467e190b466b4ecb6853702)		 Donatas Abraitis <donatas@opensourcerouting.org> no 2023-08-20
CVE-2023-38802.patch bgpd: Use treat-as-withdraw for tunnel encapsulation attribute

Before this path we used session reset method, which is discouraged by rfc7606.

Handle this as rfc requires.		 Donatas Abraitis <donatas@opensourcerouting.org> no 2023-07-13
CVE-2023-41358.patch bgpd: Do not process NLRIs if the attribute length is zero
```
3 0x00007f423aa42476 in __GI_raise (sig=sig@entry=11) at ../sysdeps/posix/raise.c:26
4 0x00007f423aef9740 in core_handler (signo=11, siginfo=0x7fffc414deb0, context=<optimized out>) at lib/sigevent.c:246
5 <signal handler called>
6 0x0000564dea2fc71e in route_set_aspath_prepend (rule=0x564debd66d50, prefix=0x7fffc414ea30, object=0x7fffc414e400)
at bgpd/bgp_routemap.c:2258
7 0x00007f423aeec7e0 in route_map_apply_ext (map=<optimized out>, prefix=prefix@entry=0x7fffc414ea30,
match_object=match_object@entry=0x7fffc414e400, set_object=set_object@entry=0x7fffc414e400, pref=pref@entry=0x0) at lib/routemap.c:2690
8 0x0000564dea2d277e in bgp_input_modifier (peer=peer@entry=0x7f4238f59010, p=p@entry=0x7fffc414ea30, attr=attr@entry=0x7fffc414e770,
afi=afi@entry=AFI_IP, safi=safi@entry=SAFI_UNICAST, rmap_name=rmap_name@entry=0x0, label=0x0, num_labels=0, dest=0x564debdd5130)
at bgpd/bgp_route.c:1772
9 0x0000564dea2df762 in bgp_update (peer=peer@entry=0x7f4238f59010, p=p@entry=0x7fffc414ea30, addpath_id=addpath_id@entry=0,
attr=0x7fffc414eb50, afi=afi@entry=AFI_IP, safi=<optimized out>, safi@entry=SAFI_UNICAST, type=9, sub_type=0, prd=0x0, label=0x0,
num_labels=0, soft_reconfig=0, evpn=0x0) at bgpd/bgp_route.c:4374
10 0x0000564dea2e2047 in bgp_nlri_parse_ip (peer=0x7f4238f59010, attr=attr@entry=0x7fffc414eb50, packet=0x7fffc414eaf0)
at bgpd/bgp_route.c:6249
11 0x0000564dea2c5a58 in bgp_nlri_parse (peer=peer@entry=0x7f4238f59010, attr=attr@entry=0x7fffc414eb50,
packet=packet@entry=0x7fffc414eaf0, mp_withdraw=mp_withdraw@entry=false) at bgpd/bgp_packet.c:339
12 0x0000564dea2c5d66 in bgp_update_receive (peer=peer@entry=0x7f4238f59010, size=size@entry=109) at bgpd/bgp_packet.c:2024
13 0x0000564dea2c901d in bgp_process_packet (thread=<optimized out>) at bgpd/bgp_packet.c:2933
14 0x00007f423af0bf71 in event_call (thread=thread@entry=0x7fffc414ee40) at lib/event.c:1995
15 0x00007f423aebb198 in frr_run (master=0x564deb73c670) at lib/libfrr.c:1213
16 0x0000564dea261b83 in main (argc=<optimized out>, argv=<optimized out>) at bgpd/bgp_main.c:505
```

With the configuration:

```
frr version 9.1-dev-MyOwnFRRVersion
frr defaults traditional
hostname ip-172-31-13-140
log file /tmp/debug.log
log syslog
service integrated-vtysh-config
!
debug bgp keepalives
debug bgp neighbor-events
debug bgp updates in
debug bgp updates out
!
router bgp 100
bgp router-id 9.9.9.9
no bgp ebgp-requires-policy
bgp bestpath aigp
neighbor 172.31.2.47 remote-as 200
!
address-family ipv4 unicast
neighbor 172.31.2.47 default-originate
neighbor 172.31.2.47 route-map RM_IN in
exit-address-family
exit
!
route-map RM_IN permit 10
set as-path prepend 200
exit
!
```

The issue is that we try to process NLRIs even if the attribute length is 0.

Later bgp_update() will handle route-maps and a crash occurs because all the
attributes are NULL, including aspath, where we dereference.

According to the RFC 4271:

A value of 0 indicates that neither the Network Layer
Reachability Information field nor the Path Attribute field is
present in this UPDATE message.

But with a fuzzed UPDATE message this can be faked. I think it's reasonable
to skip processing NLRIs if both update_len and attribute_len are 0.

(cherry picked from commit 28ccc24d38df1d51ed8a563507e5d6f6171fdd38)		 Donatas Abraitis <donatas@opensourcerouting.org> no 2023-08-22
CVE-2026-28532.patch harden OSPF TE/SR TLV iteration against malformed lengths A uint16_t accumulator truncated uint32_t TLV_SIZE() values in the OSPF TE/SR
TLV parsers (ospf_te.c, ospf_sr.c), so a crafted Opaque LSA with malformed TLV
lengths could make the loop terminator fail while the read pointer advanced,
causing an out-of-bounds read / ospfd crash (CVE-2026-28532).
.
Backported from upstream master commit d3e8aedb87; the ospf_te_delete_te() hunk
was adapted by hand because 8.4.4 still uses a uint64_t edge key instead of the
newer struct ls_edge_key.
===================================================================		 not-needed upstream backport, https://github.com/FRRouting/frr/commit/d3e8aedb87671f38db59b0df908e25e1d4af027d
CVE-2026-5107.patch improve packet parsing for EVPN and ENCAP/VNC Missing validation of the EVPN NLRI ipaddr_len against psize in the EVPN
Type-2/3/4 route handlers (and a VNC/ENCAP sub-TLV length check) allowed
crafted BGP UPDATE messages to manipulate routes or trigger a limited DoS
(CVE-2026-5107). Hand-ported from upstream to the 8.4.4 EVPN code.
===================================================================		 not-needed upstream backport, https://github.com/FRRouting/frr/commit/7676cad65114aa23adde583d91d9d29e2debd045
CVE-2025-61099_61107.patch ospfd: guard vty_out against NULL vty when dumping link/prefix info When "debug ospf packet ... detail" is enabled, ospfd dumps Opaque LSAs by
calling the per-type show helpers with a NULL vty (intending zlog output).
The TE/SR Extended-Link/Prefix dump helpers in ospf_ext.c dereferenced vty
(via vty_out) without a NULL check, so a crafted OSPF LS-Update could crash
ospfd (remote, unauthenticated DoS). This covers CVE-2025-61099, CVE-2025-61100,
CVE-2025-61101, CVE-2025-61102, CVE-2025-61103, CVE-2025-61105, CVE-2025-61106
and CVE-2025-61107; CVE-2025-61104 (check_tlv_size) is handled by the companion
patch CVE-2025-61104.patch.
.
The upstream fix (commit 034e6fe67078) rewrites the JSON-aware show functions of
a much newer ospf_ext.c. 8.4.4 predates the JSON support in these helpers, so
the same NULL-vty guard is applied directly to the 8.4.4 plain-vty_out code.
===================================================================		 not-needed upstream backport, https://github.com/FRRouting/frr/commit/034e6fe67078810b952630055614ee5710d1196e

All known versions for source package 'frr'

Links