CVE-2022-26129
📋 TL;DR
CVE-2022-26129 is a buffer overflow vulnerability in FRRouting's Babel routing daemon due to improper length validation of sub-TLV fields in Babel protocol messages. Attackers can exploit this to crash the babeld service or potentially execute arbitrary code. Organizations running FRRouting with Babel protocol enabled are affected.
💻 Affected Systems
- FRRouting (FRR)
📦 What is this software?
Frrouting by Frrouting
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, allowing attackers to take control of routing infrastructure and pivot to other network segments.
Likely Case
Denial of service through babeld service crash, disrupting routing tables and causing network instability or outages.
If Mitigated
Limited to service restart if exploit attempts are detected and blocked by network controls, with minimal operational impact.
🎯 Exploit Status
Exploitation requires sending specially crafted Babel protocol packets to vulnerable systems. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FRR 8.2 and later
Vendor Advisory: https://github.com/FRRouting/frr/issues/10503
Restart Required: Yes
Instructions:
1. Update FRR to version 8.2 or later using your distribution's package manager. 2. For Debian/Ubuntu: sudo apt update && sudo apt upgrade frr. 3. For RHEL/CentOS: sudo yum update frr. 4. Restart FRR services: sudo systemctl restart frr
🔧 Temporary Workarounds
Disable Babel Protocol
linuxIf Babel routing protocol is not required, disable it to eliminate the attack surface.
sudo vtysh
configure terminal
no router babel
end
write memory
Network Segmentation
linuxRestrict Babel protocol traffic to trusted network segments using firewall rules.
sudo iptables -A INPUT -p udp --dport 6696 -s ! TRUSTED_NETWORK -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit Babel protocol (UDP port 6696) to trusted sources only.
- Deploy intrusion detection systems to monitor for anomalous Babel protocol traffic patterns.
🔍 How to Verify
Check if Vulnerable:
Check FRR version: frr --version. If version is 8.1.0 or earlier and Babel is enabled, the system is vulnerable.Check Version:
frr --versionVerify Fix Applied:
After patching, verify FRR version is 8.2 or later: frr --version. Confirm Babel functionality if required.📡 Detection & Monitoring
Log Indicators:
- FRR/babeld crash logs
- Segmentation fault errors in system logs
- Unexpected babeld service restarts
Network Indicators:
- Unusual Babel protocol traffic patterns
- Malformed Babel packets exceeding normal TLV lengths
SIEM Query:
source="frr.log" AND ("segmentation fault" OR "buffer overflow" OR "babeld crashed")