CVE-2023-38406 – CVE-2023-38406 is a critical buffer overflow vu... (How to Fix)

Q: What is the severity of CVE-2023-38406?

CVE-2023-38406 has a CVSS score of 9.8 (CRITICAL). CVE-2023-38406 is a critical buffer overflow vulnerability in FRRouting's BGP flowspec component that allows remote attackers to execute arbitrary code or cause denial of service. The vulnerability occurs when processing BGP flowspec NLRI packets with zero length, leading to improper memory handling. Organizations using FRRouting for network routing are affected.

📋 TL;DR

CVE-2023-38406 is a critical buffer overflow vulnerability in FRRouting's BGP flowspec component that allows remote attackers to execute arbitrary code or cause denial of service. The vulnerability occurs when processing BGP flowspec NLRI packets with zero length, leading to improper memory handling. Organizations using FRRouting for network routing are affected.

💻 Affected Systems

Products:

FRRouting (FRR)

Versions: All versions before 8.4.3

Operating Systems: Linux-based systems running FRR

Default Config Vulnerable: ⚠️ Yes

Notes: Affects systems with BGP flowspec enabled. Flowspec is not enabled by default but may be configured in production environments.

📦 What is this software?

Frrouting by Frrouting

View all CVEs affecting Frrouting →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with root privileges leading to complete system compromise, network disruption, and potential lateral movement across infrastructure.

🟠

Likely Case

Denial of service causing BGP session termination and network instability, potentially leading to routing blackholes.

🟢

If Mitigated

Limited impact with proper network segmentation and BGP session filtering, potentially only causing service restart.

🌐 Internet-Facing: HIGH - BGP peers can be internet-facing, allowing remote exploitation from any BGP-speaking network.

🏢 Internal Only: MEDIUM - Internal BGP sessions could be exploited by compromised internal systems or malicious insiders.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW - Requires sending specially crafted BGP flowspec packets.

Exploitation requires BGP session establishment but no authentication beyond standard BGP peer relationships.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 8.4.3 and later

Vendor Advisory: https://github.com/FRRouting/frr/security/advisories

Restart Required: Yes

Instructions:

1. Backup current FRR configuration. 2. Stop FRR service: 'systemctl stop frr'. 3. Upgrade FRR to version 8.4.3 or later using package manager. 4. Restart FRR service: 'systemctl start frr'. 5. Verify BGP sessions re-establish.

🔧 Temporary Workarounds

Disable BGP Flowspec

linux

Disable BGP flowspec feature to prevent processing of vulnerable packet types.

vtysh
configure terminal
router bgp <AS>
no bgp flowspec
end
write memory

Filter BGP Flowspec NLRI

linux

Use route-maps to filter flowspec NLRI from BGP peers.

vtysh
configure terminal
route-map FILTER-FLOWSPEC deny 10
match nlri flowspec
router bgp <AS>
neighbor <IP> route-map FILTER-FLOWSPEC in
end
write memory

🧯 If You Can't Patch

Implement strict BGP peer filtering to only allow trusted peers
Deploy network-based intrusion detection to monitor for anomalous BGP flowspec traffic

🔍 How to Verify

Check if Vulnerable:

Check FRR version with: 'frr --version' or 'vtysh -v'. If version is below 8.4.3 and BGP flowspec is enabled, system is vulnerable.

Check Version:

frr --version

Verify Fix Applied:

After patching, verify version is 8.4.3 or higher with: 'frr --version'. Confirm BGP sessions remain stable.

📡 Detection & Monitoring

Log Indicators:

FRR crash logs
BGP session resets
Memory corruption errors in syslog

Network Indicators:

Unusual BGP flowspec traffic
BGP UPDATE messages with zero-length NLRI

SIEM Query:

source="frr.log" AND ("crash" OR "segmentation fault" OR "buffer overflow")

📊 Metadata

CVE ID: CVE-2023-38406

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-755

Published: November 6, 2023

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-38406, you might also want to check these: