CVE-2025-61105
📋 TL;DR
This vulnerability in FRRouting/frr allows attackers to cause a denial of service by sending a specially crafted OSPF packet that triggers a NULL pointer dereference. The crash occurs in the show_vty_link_info function in ospf_ext.c. Organizations running FRRouting/frr versions 4.0 through 10.4.1 with OSPF enabled are affected.
💻 Affected Systems
- FRRouting/frr
📦 What is this software?
Frrouting by Frrouting
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of routing functionality, causing network outages and loss of connectivity for all traffic passing through affected routers.
Likely Case
Router process crash requiring manual restart, causing temporary routing disruption until service is restored.
If Mitigated
Limited impact with proper network segmentation and monitoring allowing quick detection and recovery.
🎯 Exploit Status
Exploitation requires sending crafted OSPF packets to vulnerable routers. No authentication is required if OSPF is exposed to untrusted networks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v10.4.2 and later
Vendor Advisory: https://github.com/FRRouting/frr/issues/19471
Restart Required: Yes
Instructions:
1. Upgrade FRRouting/frr to version 10.4.2 or later. 2. Stop the frr service. 3. Install the updated package. 4. Restart the frr service.
🔧 Temporary Workarounds
OSPF Interface Filtering
linuxRestrict OSPF traffic to trusted interfaces only using access control lists
configure terminal
router ospf
passive-interface default
no passive-interface [trusted_interface]
OSPF Authentication
linuxEnable OSPF MD5 authentication to prevent unauthorized OSPF packets
configure terminal
interface [interface_name]
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 [password]
🧯 If You Can't Patch
- Implement strict network segmentation to isolate OSPF traffic to trusted networks only
- Deploy network monitoring and intrusion detection systems to detect and alert on suspicious OSPF traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check FRRouting version and OSPF configuration: show version | grep FRR and show running-config | include router ospfCheck Version:
show version | grep FRRVerify Fix Applied:
Verify version is 10.4.2 or later: show version | grep FRR📡 Detection & Monitoring
Log Indicators:
- FRR daemon crashes
- OSPF process termination
- Core dumps in /var/crash/
- System logs showing frr service restarts
Network Indicators:
- Unusual OSPF packet patterns
- OSPF hello packets from unexpected sources
- OSPF LSA flooding anomalies
SIEM Query:
source="frr.log" AND ("segmentation fault" OR "core dumped" OR "NULL pointer")