FRRouting Denial-of-Service Vulnerability via Crafted BGP UPDATE Message

A denial-of-service vulnerability has been identified in FRRouting (FRR) versions stable/10.0 to stable/10.6. The issue arises from missing input validation in the rfapiRibBi2Ri() function within the rfapi_rib.c file. This vulnerability allows attackers to cause a denial-of-service by sending a crafted BGP UPDATE message.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the application to become unresponsive or unavailable.

Reproduction

The vulnerability can be reproduced by sending a crafted BGP UPDATE message that exploits the lack of input validation in the rfapiRibBi2Ri() function. This can be done using a BGP speaker that supports EVPN, by manipulating the IP address length in the BGP update to trigger the denial-of-service condition.