CVE-2022-37032

An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service

published September 19, 2022

CVSS
—
EPSS
2%
Percentile
82.5
In the wild
Unconfirmed
What it is

⚠️ An out-of-bounds read in the BGP daemon of FRRouting could lead to a segmentation fault, causing a sudden service crash! 💥 Think of it like a restaurant where the chef accidentally grabs ingredients from the wrong shelf — it can lead to a disastrous meal! Similarly, this bug leads to unreliable routing behavior as the daemon tries to process unexpected data. If exploited, this vulnerability could cause the router to crash and lead to denial of service, ultimately disrupting network operations. While it might not be mind-blowingly catastrophic, it’s definitely enough to throw a wrench in your network's smooth sailing!

Put simply

Think of it like a restaurant where the chef accidentally grabs ingredients from the wrong shelf — it can lead to a disastrous meal! Similarly, this bug leads to unreliable routing behavior as the daemon tries to process unexpected data. This out-of-bounds read vulnerability occurs in the BGP daemon's capability message parsing, which can result in a segmentation fault when parsing malformed input packets.

What to do

If exploited, this vulnerability could cause the router to crash and lead to denial of service, ultimately disrupting network operations. While it might not be mind-blowingly catastrophic, it’s definitely enough to throw a wrench in your network's smooth sailing! To mitigate this, upgrade your FRRouting installation to version 8.4 or higher, ensuring the bug is patched. Regularly check for updates to stay ahead of any other potential vulnerabilities. 🛡️ You’ve got this! Keep your network robust by staying updated! 🔒

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02212 · 82.5th percentile
Published
2022-09-19T00:00Z
EPSS history
Timeline
  • 19 SEP 00:00Z
    An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service
    cvelistv5