Description
An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent boundary checks that do not account for reading 3 bytes (instead of 2) in this 0xff case.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | frr | 8.4.1-1 | — |
| Debian 13 | frr | 8.4.1-1 | — |
| Debian 12 | frr | 8.4.1-1 | — |
| Debian 10 | frr | 7.5.1-1.1+deb10u1 | DLA-3573-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | frr +1 | 8.3.1-11.el9_3 | RHSA-2023:6434 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | frr +1 | 8.3.1-11.el9_3.alma.1 | ALSA-2023:6434 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | frr +1 | 8.3.1-11.el9_3 | ELSA-2023-6434 |
Advisories 5
- ALSA-2023:6434 Moderate: frr security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- DLA-3573-1 frr - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2023:6434 Red Hat Security Advisory: frr security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2023-6434 Moderate: frr security and bug fix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 11, 2023
- WID-SEC-2023-1146 FRRouting: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 7, 2023
References
- https://github.com/FRRouting/frr/releases
- DSA-5495 vendor-advisory
- [debian-lts-announce] 20230919 [SECURITY] [DLA 3573-1] frr security update mailing-list