CVE-2023-41358

Описание

An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.

A flaw was found in FRRouting, where it is susceptible to a denial of service vulnerability triggered by a NULL pointer dereference issue during the processing of Network Layer Reachability Information (NLRIs) with a zero attribute length. The vulnerability arises from inadequate validation of user-supplied input in bgpd/bgp_packet.c when handling NLRIs. This flaw allows attackers to send specially crafted input, causing a crash that leads to a denial of service attack.