Use-after-free in frr - CVE-2022-37035

Vulnerability identifier: #VU67279

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-37035

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing BGP packets within the bgp_notify_send_with_data() and bgp_process_packet() function in bgp_packet.c. A remote attacker can send specially crafted BGP packets to the affected daemon, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

frr
Enterprise SONiC
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
openSUSE Leap
Ubuntu
frr (Ubuntu package)
frr-debuginfo
libmlag_pb0-debuginfo
libmlag_pb0
libfrrzmq0-debuginfo
libfrrzmq0
libfrrsnmp0-debuginfo
libfrrsnmp0
libfrrospfapiclient0-debuginfo
libfrrospfapiclient0
libfrrgrpc_pb0-debuginfo
libfrrgrpc_pb0
libfrrfpm_pb0-debuginfo
libfrrfpm_pb0
libfrrcares0-debuginfo
libfrrcares0
libfrr_pb0-debuginfo
libfrr_pb0
libfrr0-debuginfo
libfrr0
frr-devel
frr-debugsource
frr

Install updates from vendor's website.

frr - update to 8.3.1
frr (Ubuntu package) - addressed in versions Ubuntu Pro, 8.1-1ubuntu1.2
Enterprise SONiC - update to 4.4.1
frr-debuginfo - update to 7.4-150300.4.10.1
libmlag_pb0-debuginfo - update to 7.4-150300.4.10.1
libmlag_pb0 - update to 7.4-150300.4.10.1
libfrrzmq0-debuginfo - update to 7.4-150300.4.10.1
libfrrzmq0 - update to 7.4-150300.4.10.1
libfrrsnmp0-debuginfo - update to 7.4-150300.4.10.1
libfrrsnmp0 - update to 7.4-150300.4.10.1
libfrrospfapiclient0-debuginfo - update to 7.4-150300.4.10.1
libfrrospfapiclient0 - update to 7.4-150300.4.10.1
libfrrgrpc_pb0-debuginfo - update to 7.4-150300.4.10.1
libfrrgrpc_pb0 - update to 7.4-150300.4.10.1
libfrrfpm_pb0-debuginfo - update to 7.4-150300.4.10.1
libfrrfpm_pb0 - update to 7.4-150300.4.10.1
libfrrcares0-debuginfo - update to 7.4-150300.4.10.1
libfrrcares0 - update to 7.4-150300.4.10.1
libfrr_pb0-debuginfo - update to 7.4-150300.4.10.1
libfrr_pb0 - update to 7.4-150300.4.10.1
libfrr0-debuginfo - update to 7.4-150300.4.10.1
libfrr0 - update to 7.4-150300.4.10.1
frr-devel - update to 7.4-150300.4.10.1
frr-debugsource - update to 7.4-150300.4.10.1
frr - update to 7.4-150300.4.10.1

• https://docs.google.com/document/d/1TqYEcZbFeDTMKe2N4XRFwyAjw_mynIHfvzwbx1fmJj8/edit?usp=sharing
• https://github.com/FRRouting/frr/issues/11698

• Multiple vulnerabilities in FRRouting (FRR)
• Ubuntu update for frr
• Ubuntu update for frr
• SUSE update for frr
• Multiple vulnerabilities in Enterprise SONiC Distribution