osrg GoBGP Out-of-Bounds Read Vulnerability in BMP Parser Component

A vulnerability allowing for an out-of-bounds read has been identified in osrg GoBGP versions through 4.3.0. This issue arises in the BMP Parser component, specifically within the BMPPeerUpNotification.ParseBody and BMPStatisticsReport.ParseBody functions of pkg/packet/bmp/bmp.go. The vulnerability can be exploited remotely, leading to potential memory access issues.

Impact

Exploitation of this vulnerability causes an out-of-bounds read, which can lead to memory access violations and potentially allow for further exploitation, such as arbitrary code execution or causing a denial-of-service condition.

Remediation

Users can upgrade to osrg GoBGP version 4.4.0 or later to address this vulnerability. GoBGP 4.4.0 is available for download from the GoBGP GitHub Releases page.