CVE-2025-43970
📋 TL;DR
A buffer length validation vulnerability in GoBGP's MRT packet parsing allows attackers to cause denial of service or potentially execute arbitrary code by sending specially crafted packets. This affects all GoBGP deployments before version 3.35.0 that process MRT data from untrusted sources.
💻 Affected Systems
- GoBGP
📦 What is this software?
Gobgp by Osrg
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if memory corruption can be weaponized.
Likely Case
Denial of service through application crash or instability when processing malformed MRT packets.
If Mitigated
Limited impact if GoBGP only processes MRT data from trusted sources with proper network segmentation.
🎯 Exploit Status
Exploitation requires sending malformed MRT packets to a vulnerable GoBGP instance configured to process MRT data.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.35.0
Vendor Advisory: https://github.com/osrg/gobgp/commit/5153bafbe8dbe1a2f02a70bbf0365e98b80e47b0
Restart Required: Yes
Instructions:
1. Stop GoBGP service. 2. Update to GoBGP 3.35.0 or later using package manager or manual installation. 3. Restart GoBGP service. 4. Verify version with 'gobgp --version'.
🔧 Temporary Workarounds
Disable MRT processing
allIf MRT functionality is not required, disable MRT packet processing entirely.
# Remove or comment MRT-related configuration in gobgp.conf
# Ensure no MRT collectors or peers are configured
Network segmentation
linuxRestrict MRT data sources to trusted internal networks only.
# Configure firewall rules to block MRT traffic from untrusted sources
# Example: iptables -A INPUT -p tcp --dport <mrt-port> -s untrusted_network -j DROP
🧯 If You Can't Patch
- Implement strict network controls to allow MRT data only from trusted, verified sources.
- Monitor GoBGP processes for crashes or abnormal behavior indicating exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check GoBGP version with 'gobgp --version' and verify if below 3.35.0. Also check configuration for MRT-related settings.Check Version:
gobgp --versionVerify Fix Applied:
Confirm version is 3.35.0 or higher with 'gobgp --version'. Test MRT packet processing functionality if required.📡 Detection & Monitoring
Log Indicators:
- GoBGP process crashes
- Panic logs mentioning mrt.go
- Memory allocation errors in GoBGP logs
Network Indicators:
- Unusual MRT traffic patterns
- MRT packets with abnormal lengths from untrusted sources
SIEM Query:
source="gobgp.log" AND ("panic" OR "fatal" OR "mrt.go")