CVE-2022-42917
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/etc/frr) and replacing config files upon creation with, for example, symlinks to change the ownership of arbitrary files. This is a TOCTOU Race Condition caused by a combination of touch and chown.
Risk Assessment
A local attacker with frr user privileges can gain full root control of the system, leading to complete host compromise.
Recommendation
Upgrade FRRouting FRR to version 8.5 or later to eliminate the privilege escalation path.
Other vulnerabilities in FRRouting FRR
See all- CVE-2023-41361Critical
An issue was discovered in FRRouting FRR 9.0, where bgpd/bgp_open.c does not check for an overly large length of the rcv software version.
- CVE-2023-41360Critical
An issue was discovered in FRRouting FRR through 9.0 that allows reading the initial byte of the ORF header in an ahead-of-stream situation.
- CVE-2023-41359Critical
An issue was discovered in FRRouting FRR through 9.0 related to an out-of-bounds read in bgp_attr_aigp_valid in bgpd/bgp_attr.c. There is no check for the availability of two bytes during AIGP validation.
- CVE-2023-41358High
An issue was discovered in FRRouting FRR through 9.0, where bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.
Original NVD description (English source)
In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/etc/frr) and replacing config files upon creation with, for example, symlinks to change the ownership of arbitrary files. This is a TOCTOU Race Condition caused by a combination of touch and chown.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS