CVE-2023-41359
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
An issue was discovered in FRRouting FRR through 9.0 related to an out-of-bounds read in bgp_attr_aigp_valid in bgpd/bgp_attr.c. There is no check for the availability of two bytes during AIGP validation.
Risk Assessment
The organization may be exposed to unexpected system behavior or crashes, potentially leading to data loss or service interruptions.
Recommendation
It is recommended to update FRRouting to the latest version to mitigate this vulnerability and implement additional testing to detect potential validation issues.
Other vulnerabilities in FRRouting FRR
See all- CVE-2023-41361Critical
An issue was discovered in FRRouting FRR 9.0, where bgpd/bgp_open.c does not check for an overly large length of the rcv software version.
- CVE-2023-41360Critical
An issue was discovered in FRRouting FRR through 9.0 that allows reading the initial byte of the ORF header in an ahead-of-stream situation.
- CVE-2023-41358High
An issue was discovered in FRRouting FRR through 9.0, where bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.
Original NVD description (English source)
An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for the availability of two bytes during AIGP validation.