Logo
›
›vulnerability›CVE-2022-37035
Name
CVE-2022-37035
Source
NVD ( link)Debian ( link)
Description
An issue was discovered in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c, there is a possible use-after-free due to a race condition. This could lead to Remote Code Execution or Information Disclosure by sending crafted BGP packets. User interaction is not needed for exploitation.
CWEs
CWE-362
Published Date
Updated Date
Workaround
-
Advisories
https://docs.google.com/document/d/1TqYEcZbFeDTMKe2N4XRFwyAjw_mynIHfvzwbx1fmJj8/edit?usp=sharingExploit
https://github.com/FRRouting/frr/issues/11698Exploit
https://docs.google.com/document/d/1TqYEcZbFeDTMKe2N4XRFwyAjw_mynIHfvzwbx1fmJj8/edit?usp=sharingExploit
https://github.com/FRRouting/frr/issues/11698Exploit

Analysis#

Affected Component
Analysis
frr
Patched

Vulnerability Rating#

8.1
CVSSv31

Others affected components#

Name
Project
Project Version
Version
Status
frr
buildroot
2025.02.x
10.3
Not Affected
frr
buildroot
master
10.5.4
Not Affected
frr
openwrt
master
10.6.1-r1
Not Affected
frr
yocto
master
10.6.1
Not Affected
frr
yocto
scarthgap
9.1.3
Not Affected

Resolved with patches#

frr (yocto:kirkstone)

#
Title
Author
Resolve
1
bgpd: avoid notify race between io and main pthreads
Mark Stapp <mstapp@nvidia.com>
CVE-2022-37035