CVE-2025-61099
📋 TL;DR
A NULL pointer dereference vulnerability in FRRouting's OSPF implementation allows attackers to crash the frr daemon via specially crafted LS Update packets, causing denial of service. This affects all systems running FRRouting versions 2.0 through 10.4.1 with OSPF enabled.
💻 Affected Systems
- FRRouting (frr)
📦 What is this software?
Frrouting by Frrouting
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of routing services leading to network outages and loss of connectivity for all routes handled by the affected router.
Likely Case
frr daemon crash requiring manual restart, causing temporary routing disruption until service is restored.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and recovery.
🎯 Exploit Status
Exploitation requires OSPF adjacency with the target router. The vulnerability is triggered by a crafted LS Update packet.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v10.4.2 and later
Vendor Advisory: https://github.com/FRRouting/frr/issues/19471
Restart Required: Yes
Instructions:
1. Upgrade FRRouting to version 10.4.2 or later. 2. Stop frr service. 3. Install updated package. 4. Restart frr service.
🔧 Temporary Workarounds
Disable OSPF
linuxTemporarily disable OSPF routing protocol if not required
vtysh -c 'configure terminal' -c 'no router ospf' -c 'end' -c 'write memory'
OSPF Authentication
linuxEnable OSPF MD5 authentication to prevent unauthorized adjacency
vtysh -c 'configure terminal' -c 'router ospf' -c 'area 0 authentication message-digest' -c 'interface eth0' -c 'ip ospf message-digest-key 1 md5 yourpassword' -c 'end' -c 'write memory'
🧯 If You Can't Patch
- Implement strict network segmentation to limit OSPF adjacency to trusted routers only
- Deploy network monitoring to detect abnormal OSPF traffic patterns and potential exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check FRRouting version with 'frr --version' or 'vtysh -c 'show version'' and verify if between 2.0 and 10.4.1Check Version:
frr --versionVerify Fix Applied:
Verify version is 10.4.2 or later and test OSPF functionality remains operational📡 Detection & Monitoring
Log Indicators:
- frr daemon crash logs
- OSPF process termination messages
- Segmentation fault errors in syslog
Network Indicators:
- Unusual OSPF LS Update packets
- OSPF adjacency flapping
- Routing table inconsistencies
SIEM Query:
source="frr.log" AND ("segmentation fault" OR "NULL pointer" OR "ospf_opaque.c")