An issue was discovered in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c, there is a possible use-after-free due to a race condition. This could lead to Remote Code Execution or Information Disclosure by sending crafted BGP packets. User interaction is not needed for exploitation.
References
| Link | Resource |
|---|---|
| https://docs.google.com/document/d/1TqYEcZbFeDTMKe2N4XRFwyAjw_mynIHfvzwbx1fmJj8/edit?usp=sharing | Exploit Third Party Advisory |
| https://github.com/FRRouting/frr/issues/11698 | Exploit Third Party Advisory |
Configurations
History
10 Aug 2022, 17:07
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
| CPE | cpe:2.3:a:frrouting:frrouting:8.3:-:*:*:*:*:*:* | |
| First Time |
Frrouting frrouting
Frrouting |
|
| CWE | CWE-362 | |
| References | (MISC) https://docs.google.com/document/d/1TqYEcZbFeDTMKe2N4XRFwyAjw_mynIHfvzwbx1fmJj8/edit?usp=sharing - Exploit, Third Party Advisory | |
| References | (MISC) https://github.com/FRRouting/frr/issues/11698 - Exploit, Third Party Advisory |
02 Aug 2022, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-08-02 23:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-37035
Mitre link : CVE-2022-37035
CVE.ORG link : CVE-2022-37035
JSON object : View
Products Affected
frrouting
- frrouting
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')