Logo
›
›vulnerability›CVE-2025-61107
Name
CVE-2025-61107
Source
NVD ( link)Debian ( link)
Description
FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_pref_pref_sid function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted LSA Update packet.
CWEs
CWE-476
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/FRRouting/frr/issues/19471Exploit
https://github.com/FRRouting/frr/pull/19480Issue Tracking
https://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a1766225630aafc7e6b7c3daf3Patch
https://github.com/s1awwhy/BugList/blob/main/CVE-2025-61107.mdThird Party Advisory

Analysis#

Affected Component
Analysis
frr
Patched

Vulnerability Ratings#

7.5
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
frr
buildroot
2025.02.x
10.3
Exploitable
frr
buildroot
master
10.5.4
Not Affected
frr
openwrt
master
10.6.1-r1
Not Affected
frr
yocto
kirkstone
8.2.2
Exploitable
frr
yocto
master
10.6.1
Not Affected

Resolved with patches#

frr (yocto:scarthgap)

#
Title
Author
Resolve
1
ospfd: skip subsequent tlvs after invalid length
Louis Scalbert <louis.scalbert@6wind.com>
CVE-2025-61099
CVE-2025-61100
CVE-2025-61101
CVE-2025-61102
CVE-2025-61103
CVE-2025-61104
CVE-2025-61105
CVE-2025-61106
CVE-2025-61107
2
ospfd: Fix NULL Pointer Deference when dumping link info
s1awwhy <seawwhy@163.com>
CVE-2025-61099
CVE-2025-61100
CVE-2025-61101
CVE-2025-61102
CVE-2025-61103
CVE-2025-61104
CVE-2025-61105
CVE-2025-61106
CVE-2025-61107
3
ospfd: Add null check for vty_out in check_tlv_size
s1awwhy <seawwhy@163.com>
CVE-2025-61099
CVE-2025-61100
CVE-2025-61101
CVE-2025-61102
CVE-2025-61103
CVE-2025-61104
CVE-2025-61105
CVE-2025-61106
CVE-2025-61107
4
ospfd: reformat check_tlv_size macro
Louis Scalbert <louis.scalbert@6wind.com>
CVE-2025-61099
CVE-2025-61100
CVE-2025-61101
CVE-2025-61102
CVE-2025-61103
CVE-2025-61104
CVE-2025-61105
CVE-2025-61106
CVE-2025-61107