CVE-2022-37035 — Race Condition in Frrouting

CWE-362 — Race Condition9 documents6 sources
Severity
8.1HIGHNVD
OSV9.1OSV7.8
EPSS
2.6%
top 14.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Debian FRRFrrouting
Timeline
PublishedAug 2
Latest updateJun 5

Description

An issue was discovered in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c, there is a possible use-after-free due to a race condition. This could lead to Remote Code Execution or Information Disclosure by sending crafted BGP packets. User interaction is not needed for exploitation.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages2 packages

▶debiandebian/frr< frr 8.4.1-1 (bookworm)

🔴Vulnerability Details

4
OSV
frr vulnerabilities↗2024-06-05
▶
OSV
frr vulnerabilities↗2022-10-18
▶
GHSA
GHSA-rg6w-grg6-5wqf: An issue was discovered in bgpd in FRRouting (FRR) 8↗2022-08-03
▶
OSV
CVE-2022-37035: An issue was discovered in bgpd in FRRouting (FRR) 8↗2022-08-02
▶

📋Vendor Advisories

4
Ubuntu
FRR vulnerabilities↗2024-06-05
▶
Ubuntu
FRR vulnerabilities↗2022-10-18
▶
Red Hat
frr: use-after-free bug due to race conditions in two threads↗2022-08-03
▶
Debian
CVE-2022-37035: frr - An issue was discovered in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_...↗2022
▶