osrg GoBGP Buffer Overflow Vulnerability in AIGP Attribute Parser

A buffer overflow vulnerability has been identified in osrg GoBGP versions through 4.3.0. The issue arises in the AIGP Attribute Parser, specifically within the PathAttributeAigp.DecodeFromBytes function in pkg/packet/bgp/bgp.go. The vulnerability can be exploited remotely by manipulating the AIGP path attribute parsing, leading to a buffer overflow condition.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can potentially be used to execute arbitrary code or cause a denial-of-service condition by crashing the application.

Remediation

Users can upgrade to GoBGP version 4.4.0 or later to address this vulnerability. Version 4.4.0 is available as a binary release and can be downloaded from the GoBGP GitHub Releases page.