CVE-2024-34088
📋 TL;DR
This vulnerability in FRRouting (FRR) allows attackers to cause a denial of service by triggering a NULL pointer dereference in the OSPF daemon. When the get_edge() function returns NULL and calling functions don't handle this properly, the OSPF process crashes. Network administrators using FRR for OSPF routing are affected.
💻 Affected Systems
- FRRouting (FRR)
📦 What is this software?
Frrouting by Frrouting
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of OSPF routing, causing network outages and traffic blackholing across the affected network segment
Likely Case
OSPF daemon crashes repeatedly, causing intermittent routing instability and requiring manual process restarts
If Mitigated
Limited to single OSPF instance disruption if proper segmentation and redundancy are in place
🎯 Exploit Status
Exploitation requires network access to OSPF port 89, but no authentication
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.2 and later, or apply commit 34d704fb0ea60dc5063af477a2c11d4884984d4f
Vendor Advisory: https://github.com/FRRouting/frr/pull/15674
Restart Required: Yes
Instructions:
1. Update FRR to version 9.2 or later. 2. Restart the OSPF daemon (ospfd). 3. Verify OSPF adjacency re-establishes.
🔧 Temporary Workarounds
Disable OSPF Traffic Engineering
linuxRemove Traffic Engineering extensions from OSPF configuration
vtysh -c 'configure terminal' -c 'router ospf' -c 'no mpls-te'
Implement OSPF authentication
linuxAdd MD5 authentication to OSPF to prevent unauthorized packets
vtysh -c 'configure terminal' -c 'router ospf' -c 'area 0 authentication message-digest'
🧯 If You Can't Patch
- Implement strict network segmentation to limit OSPF traffic to trusted sources only
- Deploy network monitoring to detect OSPF daemon crashes and implement automatic restart scripts
🔍 How to Verify
Check if Vulnerable:
Check FRR version: vtysh -c 'show version' | grep -i frrCheck Version:
vtysh -c 'show version'Verify Fix Applied:
Verify version is 9.2+ and check OSPF daemon stability: systemctl status frr or ps aux | grep ospfd📡 Detection & Monitoring
Log Indicators:
- OSPF daemon crash messages in /var/log/frr/ospfd.log
- Repeated OSPF process restarts in system logs
Network Indicators:
- Unusual OSPF packet patterns on port 89
- OSPF adjacency flapping
SIEM Query:
source="/var/log/frr/ospfd.log" AND "segmentation fault" OR "core dumped"