Description
An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4. When sending a malformed BGP OPEN message that ends with the option length octet (or the option length word, in case of an extended OPEN message), the FRR code reads of out of the bounds of the packet, throwing a SIGABRT signal and exiting. This results in a bgpd daemon restart, causing a Denial-of-Service condition.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | frr | 8.4.1-1 | — |
| Debian 13 | frr | 8.4.1-1 | — |
| Debian 12 | frr | 8.4.1-1 | — |
| Debian 10 | frr | 7.5.1-1.1+deb10u1 | DLA-3573-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | frr +1 | 8.3.1-11.el9_3 | RHSA-2023:6434 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | frr +1 | 8.3.1-11.el9_3.alma.1 | ALSA-2023:6434 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | frr +1 | 8.3.1-11.el9_3 | ELSA-2023-6434 |
Advisories 5
- ALSA-2023:6434 Moderate: frr security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- DLA-3573-1 frr - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2023:6434 Red Hat Security Advisory: frr security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2023-6434 Moderate: frr security and bug fix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 11, 2023
- WID-SEC-2023-1146 FRRouting: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 7, 2023
References
- https://forescout.com
- DSA-5495 vendor-advisory
- [debian-lts-announce] 20230919 [SECURITY] [DLA 3573-1] frr security update mailing-list