CVE-2023-38802
📋 TL;DR
This vulnerability allows remote attackers to cause denial of service (DoS) in FRRouting and Pica8 PICOS systems by sending specially crafted BGP updates with corrupted Tunnel Encapsulation attributes. Attackers can crash BGP processes, disrupting network routing. Organizations running affected FRR or PICOS versions with BGP enabled are vulnerable.
💻 Affected Systems
- FRRouting FRR
- Pica8 PICOS
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Frrouting by Frrouting
Picos by Pica8
⚠️ Risk & Real-World Impact
Worst Case
Complete BGP process crash leading to widespread routing disruption, network outages, and potential cascading failures across interconnected networks.
Likely Case
Targeted BGP process crashes causing localized routing disruptions and requiring manual intervention to restart services.
If Mitigated
Minimal impact with proper network segmentation, BGP session filtering, and monitoring that can quickly detect and respond to anomalous BGP traffic.
🎯 Exploit Status
Exploitation requires sending BGP packets to vulnerable systems, which is straightforward for attackers with network access to BGP peers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FRR 9.0.1 and later, PICOS updates as per vendor
Vendor Advisory: https://github.com/FRRouting/frr/releases
Restart Required: Yes
Instructions:
1. Update FRR to version 9.0.1 or later. 2. For PICOS, apply vendor-provided patches. 3. Restart BGP processes or reboot affected systems.
🔧 Temporary Workarounds
BGP Session Filtering
linuxFilter BGP sessions to only allow trusted peers and block unauthorized BGP updates.
# Configure BGP neighbor filtering in FRR
neighbor <IP> prefix-list FILTER_IN in
neighbor <IP> prefix-list FILTER_OUT out
Rate Limiting BGP Updates
linuxImplement rate limiting on BGP updates to reduce impact of malicious packets.
# Set BGP update rate limiting
router bgp <AS>
neighbor <IP> maximum-prefix <limit>
🧯 If You Can't Patch
- Implement strict BGP peer filtering to only allow trusted, verified BGP sessions.
- Deploy network monitoring to detect anomalous BGP traffic patterns and potential exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check FRR version with 'frr --version' or 'show version' in FRR CLI. If version is between 7.5.1 and 9.0 inclusive, system is vulnerable.Check Version:
frr --versionVerify Fix Applied:
Verify FRR version is 9.0.1 or later. Test BGP stability by monitoring process uptime and checking for crashes after receiving BGP updates.📡 Detection & Monitoring
Log Indicators:
- BGP process crashes in system logs
- Unexpected BGP session resets
- Error messages related to Tunnel Encapsulation attribute parsing
Network Indicators:
- Unusual BGP update patterns from untrusted sources
- BGP packets with malformed Tunnel Encapsulation attributes
SIEM Query:
source="*syslog*" AND ("bgpd crashed" OR "BGP process terminated unexpectedly" OR "attribute 23 error")🔗 References
- https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling
- https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JLG64IF3FU7V76K4TKCCXVNEE6P2VUDO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMJNX44SMJM25JZO7XWHDQCOB4SNJPIE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXR6PIVY4SWO7HDT4EY733H4X32SCPM4/
- https://news.ycombinator.com/item?id=37305800
- https://www.debian.org/security/2023/dsa-5495
- https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling
- https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JLG64IF3FU7V76K4TKCCXVNEE6P2VUDO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMJNX44SMJM25JZO7XWHDQCOB4SNJPIE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXR6PIVY4SWO7HDT4EY733H4X32SCPM4/
- https://news.ycombinator.com/item?id=37305800
- https://www.debian.org/security/2023/dsa-5495
