CVE-2022-36440
📋 TL;DR
This vulnerability allows attackers to cause a denial-of-service (DoS) in FRRouting's BGP daemon by sending specially crafted BGP open packets. The reachable assertion in the peek_for_as4_capability function crashes frr-bgpd when exploited. Organizations running vulnerable versions of FRRouting with BGP enabled are affected.
💻 Affected Systems
- FRRouting (frr-bgpd)
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Frrouting by Frrouting
⚠️ Risk & Real-World Impact
Worst Case
Complete BGP session disruption leading to network outages and routing instability across affected BGP peers.
Likely Case
Targeted DoS attacks against specific BGP peers causing service disruption until the daemon is restarted.
If Mitigated
Limited impact with proper network segmentation and BGP session filtering in place.
🎯 Exploit Status
Proof-of-concept code is publicly available. Attack requires ability to send BGP packets to vulnerable peers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check distribution-specific updates (e.g., Debian security updates, Fedora updates)
Vendor Advisory: https://github.com/FRRouting/frr/security/advisories
Restart Required: Yes
Instructions:
1. Check your distribution's security advisories. 2. Apply security updates for frr package. 3. Restart frr-bgpd service. 4. Verify the fix is applied.
🔧 Temporary Workarounds
BGP Session Filtering
linuxImplement BGP session filtering to only allow connections from trusted peers.
# Configure BGP neighbor filtering in frr.conf
neighbor TRUSTED_PEER route-map FILTER_IN in
neighbor TRUSTED_PEER route-map FILTER_OUT out
🧯 If You Can't Patch
- Implement strict BGP peer filtering and network ACLs to limit exposure
- Monitor BGP sessions and implement automated restart mechanisms for frr-bgpd
🔍 How to Verify
Check if Vulnerable:
Check frr-bgpd version: 'frr --version' or 'dpkg -l | grep frr' or 'rpm -q frr'Check Version:
frr --versionVerify Fix Applied:
Verify updated package version and test BGP session stability with known good peers.📡 Detection & Monitoring
Log Indicators:
- frr-bgpd crash logs
- BGP session resets
- Assertion failures in system logs
Network Indicators:
- Unexpected BGP open packets from unknown sources
- BGP session flaps
SIEM Query:
source="frr.log" AND ("assertion" OR "crash" OR "abort")🔗 References
- https://github.com/spwpun/pocs
- https://github.com/spwpun/pocs/blob/main/frr-bgpd.md
- https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HU4PKLUVB5CTMOVQ2GV33TNUNMJCBGD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBXEXL2ZQBWCBLNUP6P67FHECXQWSK3L/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GM66PNHGCXZU66LQCTP2FSJLFF6CVMSI/
- https://www.debian.org/security/2023/dsa-5495
- https://github.com/spwpun/pocs
- https://github.com/spwpun/pocs/blob/main/frr-bgpd.md
- https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HU4PKLUVB5CTMOVQ2GV33TNUNMJCBGD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBXEXL2ZQBWCBLNUP6P67FHECXQWSK3L/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GM66PNHGCXZU66LQCTP2FSJLFF6CVMSI/
- https://www.debian.org/security/2023/dsa-5495
