Bug 1213434 (CVE-2023-3748) - VUL-0: CVE-2023-3748: frr: Inifinite loop in babld message parsing may cause DoS
Summary: VUL-0: CVE-2023-3748: frr: Inifinite loop in babld message parsing may cause DoS
Status: RESOLVED FIXED
Alias: CVE-2023-3748
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/372802/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-3748:6.2:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-07-18 14:28 UTC by Gianluca Gabrielli
Modified: 2024-04-18 09:23 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Gianluca Gabrielli 2023-07-18 14:28:11 UTC 
An issue was discovered in frr from 8.3 when parsing certain babeld unicast hello messages that were intended to be ignored. Hello messages with the unicast flag set, the interval field set to 0, or any TLV that contains a sub-TLV with the Mandatory flag set could enter an infinite loop.

https://github.com/FRRouting/frr/issues/11808

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3748
https://bugzilla.redhat.com/show_bug.cgi?id=2223668
Comment 1 Gianluca Gabrielli 2023-07-18 14:29:02 UTC 
Affected packages:
 - SUSE:SLE-15-SP5:Update/frr
 - openSUSE:Factory/frr

Upstream patch: https://github.com/FRRouting/frr/commit/0f46adebe43c0ba7d9cb160a63c98057fb227722.patch
Comment 6 Maintenance Automation 2023-09-20 20:30:15 UTC 
SUSE-SU-2023:3709-1: An update that solves five vulnerabilities can now be installed.

Category: security (important)
Bug References: 1213284, 1213434, 1214735, 1214739, 1215065
CVE References: CVE-2023-3748, CVE-2023-38802, CVE-2023-41358, CVE-2023-41360, CVE-2023-41909
Sources used:
openSUSE Leap 15.5 (src): frr-8.4-150500.4.8.1
Server Applications Module 15-SP5 (src): frr-8.4-150500.4.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Marcus Meissner 2024-04-18 09:23:52 UTC 
done