In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's buffer size, default 4K on most OSes. An attacker can use this to trigger re-parsing of the RIB for FRR routers using RTR by causing more than this number of updates during an update interval (usually 30 minutes). Additionally, this effect regularly occurs organically. Furthermore, an attacker can use this to trigger route validation continuously. Given that routers with large full tables may need more than 30 minutes to fully re-validate the table, continuous issuance/withdrawal of large numbers of ROA may be used to impact the route handling performance of all FRR instances using RPKI globally. Additionally, the re-validation will cause heightened BMP traffic to ingestors. Fixed Versions: 10.0.3, 10.1.2, 10.2.1, >= 10.3.

An update of the frr package has been released.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7230-2 advisory.

    Iggy Frankovic discovered that FRR incorrectly handled certain BGP messages. A remote attacker could     possibly use this issue to cause FRR to crash, resulting in a denial of service. This issue only affected     Ubuntu 20.04 LTS. (CVE-2024-44070)

    It was discovered that FRR re-validated all routes in certain instances when the internal socket's buffer     size overflowed. A remote attacker could possibly use this issue to impact the performance of FRR,     resulting in a denial of service. (CVE-2024-55553)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4029 advisory.

    -lts-announce@lists.debian.org     Subject: [SECURITY] [DLA 4029-1] frr security update

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4029-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/              Arturo Borrero Gonzalez     January 23, 2025                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : frr     Version        : 7.5.1-1.1+deb11u4     CVE ID         : CVE-2024-55553

    In FRR, the internet routing protocol suite software, all routes are     re-validated if the total size of an update received via RTR exceeds the     internal socket's buffer size, default 4K on most OSes.

    An attacker can use this to trigger re-parsing of the RIB for FRR routers     using RTR by causing more than this number of updates during an update     interval (usually 30 minutes). Additionally, this effect regularly occurs     organically. Furthermore, an attacker can use this to trigger route validation     continuously. Given that routers with large full tables may need more than     30 minutes to fully re-validate the table, continuous issuance/withdrawal of     large numbers of ROA may be used to impact the route handling performance of     all FRR instances using RPKI globally. Additionally, the re-validation will     cause heightened BMP traffic to ingestors.

    For Debian 11 bullseye, this problem has been fixed in version     7.5.1-1.1+deb11u4.

    We recommend that you upgrade your frr packages.

    For the detailed security status of frr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/frr

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
215204	Photon OS 5.0: Frr PHSA-2025-5.0-0462	Nessus	PhotonOS Local Security Checks	high
214670	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : FRR vulnerabilities (USN-7230-2)	Nessus	Ubuntu Local Security Checks	high
214524	Debian dla-4029 : frr - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2024-55553

high

Tenable Plugins

high

high

high