Main Vulnerability Database Vulnerabilities #VU101850

Infinite loop in frr - CVE-2024-31949

Published: December 19, 2024

Vulnerability identifier: #VU101850

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-31949

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when receiving a MP/GR capability as a dynamic capability. A remote attacker can consume all available system resources and cause denial of service conditions.

Affected software

frr
Enterprise SONiC
Fedora
frr

How to mitigate CVE-2024-31949

Install updates from vendor's website.

frr - addressed in versions 9.0.4, 10.1
Enterprise SONiC - update to 4.4.1
frr - update to 9.1.1-1.fc40

External References

https://github.com/FRRouting/frr/pull/15640
https://github.com/FRRouting/frr/pull/15640/commits/30a332dad86fafd2b0b6c61d23de59ed969a219b
https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html

Related Security Bulletins