CVE-2023-41358 – A NULL pointer dereference vulnerability in FRR... (How to Fix)

Q: What is the severity of CVE-2023-41358?

CVE-2023-41358 has a CVSS score of 7.5 (HIGH). A NULL pointer dereference vulnerability in FRRouting's BGP daemon allows remote attackers to cause denial of service by sending specially crafted BGP packets with zero-length attributes. This affects FRRouting installations running BGP, potentially disrupting network routing.

📋 TL;DR

A NULL pointer dereference vulnerability in FRRouting's BGP daemon allows remote attackers to cause denial of service by sending specially crafted BGP packets with zero-length attributes. This affects FRRouting installations running BGP, potentially disrupting network routing.

💻 Affected Systems

Products:

FRRouting (FRR)

Versions: All versions through 9.0

Operating Systems: Linux distributions including Debian, Fedora, Ubuntu

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with BGP enabled and configured

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete BGP daemon crash leading to routing table loss and network connectivity disruption

🟠

Likely Case

BGP daemon crash requiring manual restart, causing temporary routing instability

🟢

If Mitigated

Minimal impact if proper segmentation and monitoring are in place

🌐 Internet-Facing: HIGH - BGP peers are typically internet-facing and can be targeted by remote attackers

🏢 Internal Only: MEDIUM - Internal BGP peers could exploit but require network access

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW - Requires sending malformed BGP packets

Exploitation requires BGP peer relationship or ability to send BGP packets to vulnerable system

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in FRR 9.0.1 and later

Vendor Advisory: https://github.com/FRRouting/frr/pull/14260

Restart Required: Yes

Instructions:

1. Update FRR to version 9.0.1 or later. 2. For Debian/Fedora: Use package manager updates. 3. Restart bgpd service: 'systemctl restart frr' or 'service frr restart'

🔧 Temporary Workarounds

BGP Peer Filtering

linux

Restrict BGP peer connections to trusted sources only

# Configure BGP peer filtering in frr.conf
neighbor <trusted-peer> remote-as <as-number>
neighbor <trusted-peer> prefix-list trusted-peers in

🧯 If You Can't Patch

Implement strict BGP peer authentication using MD5 or TCP-AO
Deploy network segmentation to isolate BGP traffic from untrusted networks

🔍 How to Verify

Check if Vulnerable:

Check FRR version: 'frr --version' or 'vtysh -c 'show version''. If version is 9.0 or earlier, system is vulnerable.

Check Version:

frr --version

Verify Fix Applied:

Verify FRR version is 9.0.1 or later. Check bgpd process is running: 'systemctl status frr' or 'ps aux | grep bgpd'

📡 Detection & Monitoring

Log Indicators:

BGP daemon crashes in syslog
Unexpected bgpd restarts
BGP session resets with malformed packet errors

Network Indicators:

BGP UPDATE packets with zero-length attributes
Unexpected BGP session terminations

SIEM Query:

source="syslog" AND ("bgpd" OR "frr") AND ("crash" OR "segfault" OR "restart")

📊 Metadata

CVE ID: CVE-2023-41358

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: August 29, 2023

Last Updated: November 21, 2024

🔗 References

https://github.com/FRRouting/frr/pull/14260 Patch,Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JLG64IF3FU7V76K4TKCCXVNEE6P2VUDO/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMJNX44SMJM25JZO7XWHDQCOB4SNJPIE/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXR6PIVY4SWO7HDT4EY733H4X32SCPM4/ Mailing List
https://www.debian.org/security/2023/dsa-5495 Third Party Advisory
https://github.com/FRRouting/frr/pull/14260 Patch,Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JLG64IF3FU7V76K4TKCCXVNEE6P2VUDO/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMJNX44SMJM25JZO7XWHDQCOB4SNJPIE/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXR6PIVY4SWO7HDT4EY733H4X32SCPM4/ Mailing List
https://www.debian.org/security/2023/dsa-5495 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-41358, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Debian Linux by Debian

Debian Linux by Debian

Fedora by Fedoraproject

Fedora by Fedoraproject

Fedora by Fedoraproject

Frrouting by Frrouting

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

BGP Peer Filtering

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities