FRRouting Off-By-One Write Vulnerability in FlowSpec Operator Decoding Function Allowing Denial-of-Service

An off-by-one out-of-bounds write vulnerability has been identified in the bgp_flowspec_op_decode() function of FRRouting (FRR) stable/10.0. This vulnerability allows attackers to cause a denial-of-service by supplying a crafted FlowSpec component. The issue arises from improper bounds checking in the FlowSpec operator array, which can be exploited when more than five chained operators are present.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the application to become unresponsive or unavailable.

Remediation

Users can update to the latest version of FRRouting where this vulnerability has been patched. Instructions for updating can be found in the FRRouting documentation.