Skip to content
OpenAdvisories
Unscored Public exploit CVE-2022-37032 EUVD-2022-39686GHSA-mxrw-2vpr-fpwr

An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in …

Published Sep 19, 2022 · Updated Aug 3, 2024 · Assigned by mitre

Package: frr Package: frr Package: quagga Ecosystem: Debian Ecosystem: Ubuntu

Description

An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 frr 8.4.1-1 —
Debian 13 frr 8.4.1-1 —
Debian 12 frr 8.4.1-1 —
Debian 11 frr 7.5.1-1.1+deb11u1 DSA-5362-1
Debian 10 frr 6.0.2-2+deb10u2 DLA-3211-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS frr 8.1-1ubuntu1.2 USN-5685-1
Ubuntu 20.04 LTS quagga 1.2.4-4ubuntu0.4 USN-6482-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS frr 7.2.1-1ubuntu0.2+esm2 USN-6807-1
Ubuntu Pro 18.04 LTS quagga No fix yet —
Ubuntu Pro 16.04 LTS quagga No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 frr +1 8.3.1-5.el9 RHSA-2023:2202
RHEL 8 frr +1 7.5.1-7.el8 RHSA-2023:2801

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 frr +1 8.3.1-5.el9 ALSA-2023:2202
AlmaLinux 8 frr +1 7.5.1-7.el8 ALSA-2023:2801

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 quagga 1.1.1-150400.12.8.1 SUSE-SU-2024:3478-1
SLES 15 SP5 quagga 1.1.1-150400.12.8.1 SUSE-SU-2024:3478-1
SLES 15 SP4 frr 7.4-150300.4.7.1 SUSE-SU-2022:3246-1
SLES 15 SP4 quagga 1.1.1-150400.12.8.1 SUSE-SU-2024:3478-1
SLES 15 SP3 frr 7.4-150300.4.7.1 SUSE-SU-2022:3246-1
SLES 15 SP3 quagga 1.1.1-150000.4.6.1 SUSE-SU-2024:3433-1
SLES 15 SP2 quagga 1.1.1-150000.4.6.1 SUSE-SU-2024:3433-1
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 quagga 1.1.1-17.13.1 SUSE-SU-2024:3426-1
SLES for SAP 15 SP4 quagga 1.1.1-150400.12.8.1 SUSE-SU-2024:3478-1
SLES for SAP 15 SP3 quagga 1.1.1-150000.4.6.1 SUSE-SU-2024:3433-1
SLES for SAP 15 SP2 quagga 1.1.1-150000.4.6.1 SUSE-SU-2024:3433-1
SLES for SAP 12 SP5 quagga 1.1.1-17.13.1 SUSE-SU-2024:3426-1
SLE HPC 15 SP4 quagga 1.1.1-150400.12.8.1 SUSE-SU-2024:3478-1
SLE HPC 15 SP3 quagga 1.1.1-150000.4.6.1 SUSE-SU-2024:3433-1
SLE HPC 15 SP2 quagga 1.1.1-150000.4.6.1 SUSE-SU-2024:3433-1
SUSE Manager Server 4.3 quagga 1.1.1-150400.12.8.1 SUSE-SU-2024:3478-1
SUSE Manager Proxy 4.3 quagga 1.1.1-150400.12.8.1 SUSE-SU-2024:3478-1
SUSE Enterprise Storage 7.1 quagga 1.1.1-150000.4.6.1 SUSE-SU-2024:3433-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed frr 8.1-5.1 openSUSE-SU-2024:12307-1
openSUSE Leap 15.6 quagga 1.1.1-150400.12.8.1 SUSE-SU-2024:3478-1
openSUSE Leap 15.5 quagga 1.1.1-150400.12.8.1 SUSE-SU-2024:3478-1
openSUSE Leap 15.4 frr 7.4-150300.4.7.1 SUSE-SU-2022:3246-1
openSUSE Leap 15.3 frr 7.4-150300.4.7.1 SUSE-SU-2022:3246-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 frr +1 8.3.1-5.el9 ELSA-2023-2202
Oracle Linux 8 frr +1 7.5.1-7.0.1.el8 ELSA-2023-2801

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 19

References