CVE-2024-31948

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-31948
In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crash.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/FRRouting/frr/pull/15628 Issue Tracking Third Party Advisory
https://github.com/FRRouting/frr/pull/15628/commits/ba6a8f1a31e1a88df2de69ea46068e8bd9b97138 Patch
https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html Mailing List
https://github.com/FRRouting/frr/pull/15628 Issue Tracking Third Party Advisory
https://github.com/FRRouting/frr/pull/15628/commits/ba6a8f1a31e1a88df2de69ea46068e8bd9b97138 Patch
https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html Mailing List
Configurations

Configuration 1 (hide)

cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*
History

01 May 2025, 14:47

Type Values Removed Values Added
First Time Frrouting frrouting
Frrouting
References () https://github.com/FRRouting/frr/pull/15628 - () https://github.com/FRRouting/frr/pull/15628 - Issue Tracking, Third Party Advisory
References () https://github.com/FRRouting/frr/pull/15628/commits/ba6a8f1a31e1a88df2de69ea46068e8bd9b97138 - () https://github.com/FRRouting/frr/pull/15628/commits/ba6a8f1a31e1a88df2de69ea46068e8bd9b97138 - Patch
References () https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html - () https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html - Mailing List
CPE cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*

21 Nov 2024, 09:14

Type Values Removed Values Added
References () https://github.com/FRRouting/frr/pull/15628 - () https://github.com/FRRouting/frr/pull/15628 -
References () https://github.com/FRRouting/frr/pull/15628/commits/ba6a8f1a31e1a88df2de69ea46068e8bd9b97138 - () https://github.com/FRRouting/frr/pull/15628/commits/ba6a8f1a31e1a88df2de69ea46068e8bd9b97138 -
References () https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html - () https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html -

03 Jul 2024, 01:55

Type Values Removed Values Added
CWE CWE-1287
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

28 Apr 2024, 07:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html -

08 Apr 2024, 18:48

Type Values Removed Values Added
Summary
  • (es) En FRRouting (FRR) hasta 9.1, un atacante que utiliza un atributo SID de prefijo con formato incorrecto en un paquete de BGP UPDATE puede provocar que el daemon bgpd falle.

07 Apr 2024, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-07 21:15

Updated : 2025-05-01 14:47

NVD link : CVE-2024-31948

Mitre link : CVE-2024-31948

CVE.ORG link : CVE-2024-31948

JSON object : View

Products Affected

frrouting

  • frrouting
CWE
CWE-1287

Improper Validation of Specified Type of Input