Description
In FRRouting (FRR) 8.3 through 10.5.1, bgp_notify_decapsulate_hard_reset() in bgpd/bgp_packet.c does not validate the length of the data field of a received BGP NOTIFICATION Cease/Hard Reset message (RFC 8538). When the data field is exactly one byte long, the function reads one byte past the end of a heap buffer and the 16-bit length of the encapsulated data underflows to 65535, causing a 65535-byte out-of-bounds heap read followed by an assertion failure. A remote BGP peer that has established a session and negotiated the Graceful Restart capability with the Notification (N) bit can send such a message to crash the bgpd daemon, terminating all BGP sessions (denial of service). This is fixed in 10.0.5, 10.1.5, 10.2.6, 10.3.4, 10.4.3, 10.5.2 and 10.6.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | FRRouting | 10.2 <10.2.6 | — |
| — | FRRouting | 8.3 <10.0.5 | — |
| — | FRRouting | 10.3 <10.3.4 | — |
| — | FRRouting | 10.4.0 <10.4.3 | — |
| — | FRRouting | 10.1 <10.1.5 | — |
| — | FRRouting | 10.5.0 <10.5.2 | — |