CVE-2022-36440

Опубликовано: 03 апр. 2023

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek_for_as4_capability function. Attackers can maliciously construct BGP open packets and send them to BGP peers running frr-bgpd, resulting in DoS.

Ссылки

https://github.com/spwpun/pocs
Third Party Advisory
https://github.com/spwpun/pocs/blob/main/frr-bgpd.md
Exploit
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HU4PKLUVB5CTMOVQ2GV33TNUNMJCBGD/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBXEXL2ZQBWCBLNUP6P67FHECXQWSK3L/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GM66PNHGCXZU66LQCTP2FSJLFF6CVMSI/
Mailing List
Third Party Advisory
https://www.debian.org/security/2023/dsa-5495
Third Party Advisory
https://github.com/spwpun/pocs
Third Party Advisory
https://github.com/spwpun/pocs/blob/main/frr-bgpd.md
Exploit
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HU4PKLUVB5CTMOVQ2GV33TNUNMJCBGD/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBXEXL2ZQBWCBLNUP6P67FHECXQWSK3L/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GM66PNHGCXZU66LQCTP2FSJLFF6CVMSI/
Mailing List
Third Party Advisory
https://www.debian.org/security/2023/dsa-5495
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:frrouting:frrouting:8.3:-:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

EPSS

Процентиль: 43%

0.00201

Низкий

7.5 High

CVSS3

Дефекты

CWE-617

Связанные уязвимости

CVE-2022-36440

CVSS3: 7.5

ubuntu

около 2 лет назад

CVE-2022-36440

CVSS3: 7.5

redhat

около 2 лет назад

CVE-2022-36440

CVSS3: 7.5

debian

около 2 лет назад

A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the pee ...

GHSA-cpmq-crvm-2w5p

CVSS3: 7.5

github

около 2 лет назад

BDU:2023-02836

CVSS3: 7.5

fstec

около 2 лет назад

Уязвимость функции peek_for_as4_capability программного средства реализации сетевой маршрутизации на Unix-подобных системах FRRouting, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 43%

0.00201

Низкий

7.5 High

CVSS3

Дефекты

CWE-617