CVE-2025-61104
📋 TL;DR
This vulnerability in FRRouting (FRR) allows attackers to cause a denial of service by sending a specially crafted OSPF packet that triggers a NULL pointer dereference. The crash occurs in the show_vty_unknown_tlv function when processing OSPF packets with unknown TLVs. Organizations running FRR versions 4.0 through 10.4.1 with OSPF enabled are affected.
💻 Affected Systems
- FRRouting (FRR)
📦 What is this software?
Frrouting by Frrouting
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of FRR routing daemon, causing network outages and loss of routing functionality for affected devices.
Likely Case
FRR daemon crashes, requiring manual restart to restore routing services, causing temporary network disruption.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and recovery.
🎯 Exploit Status
Exploitation requires network access to OSPF-enabled interfaces. The vulnerability is triggered by packets with unknown TLVs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v10.4.2 and later
Vendor Advisory: https://github.com/FRRouting/frr/issues/19471
Restart Required: Yes
Instructions:
1. Update FRR to version 10.4.2 or later using your distribution's package manager. 2. For source installations, pull the latest code from GitHub and rebuild. 3. Restart the FRR service after updating.
🔧 Temporary Workarounds
Disable OSPF
linuxTemporarily disable OSPF routing protocol if not required.
vtysh -c 'configure terminal' -c 'no router ospf'
OSPF Interface Filtering
linuxUse ACLs to restrict OSPF packets to trusted sources only.
vtysh -c 'configure terminal' -c 'access-list 1 permit 10.0.0.0/8' -c 'router ospf' -c 'distribute-list 1 in'
🧯 If You Can't Patch
- Implement network segmentation to isolate OSPF traffic to trusted zones only.
- Deploy network monitoring and intrusion detection systems to detect and alert on suspicious OSPF packets.
🔍 How to Verify
Check if Vulnerable:
Check FRR version with 'frr --version' or 'vtysh -c 'show version''. If version is between 4.0 and 10.4.1 inclusive, and OSPF is enabled, the system is vulnerable.Check Version:
frr --versionVerify Fix Applied:
After patching, verify version is 10.4.2 or later and test OSPF functionality remains operational.📡 Detection & Monitoring
Log Indicators:
- FRR daemon crash logs in system logs
- OSPF process restart messages
- Segmentation fault errors in FRR logs
Network Indicators:
- Unusual OSPF packets with unknown TLVs
- OSPF neighbor flapping
- Sudden loss of OSPF routes
SIEM Query:
source="frr.log" AND ("segmentation fault" OR "crash" OR "NULL pointer")