Bugzilla – Bug 1222521
VUL-0: CVE-2024-31949: frr,quagga: infinite loop
Last modified: 2024-06-05 14:49:50 UTC
In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a dynamic capability because malformed data results in a pointer not advancing. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-31949 https://www.cve.org/CVERecord?id=CVE-2024-31949 https://github.com/FRRouting/frr/pull/15640 https://github.com/FRRouting/frr/pull/15640/commits/30a332dad86fafd2b0b6c61d23de59ed969a219b https://bugzilla.redhat.com/show_bug.cgi?id=2273992
quagga is not affected, but frr is: - SUSE:SLE-15-SP3:Update/frr - SUSE:SLE-15-SP5:Update/frr - openSUSe:Factory/frr
We are running: SUSE:SLE-15-SP3:Update/frr => 7.4 SUSE:SLE-15-SP5:Update/frr => 8.4 openSUSe:Factory/frr => 8.4 And from my point of view this CVE doesn't apply there. Explanation: the issue occur, because of an `continue` in a while loop over a pointer, before incrementing that. This is not happen in 7.4[1] or 8.4[2], as the pointer increase takes places before any `continue` call. I think it was introduced with [3]. [1] https://github.com/FRRouting/frr/blob/stable/7.4/bgpd/bgp_packet.c#L2191 [2] https://github.com/FRRouting/frr/blob/stable/8.4/bgpd/bgp_packet.c#L2723 [3] https://github.com/FRRouting/frr/commit/bf11a9eb252d7802871d3315e768068fb146a292
(In reply to Clemens Famulla-Conrad from comment #2) > We are running: > SUSE:SLE-15-SP3:Update/frr => 7.4 > SUSE:SLE-15-SP5:Update/frr => 8.4 > openSUSe:Factory/frr => 8.4 > > And from my point of view this CVE doesn't apply there. > > Explanation: > the issue occur, because of an `continue` in a while loop over a pointer, > before incrementing that. > This is not happen in 7.4[1] or 8.4[2], as the pointer increase takes places > before any `continue` call. I think it was introduced with [3]. Correct, I think you're right. Thanks for noticing it. Let me adjust the tracking. Do you plan to update openSUSE:Factory to a 9.x version? Otherwise I will close this bug
Valid question, but I cannot answer it. I would like to leave this question for Marius as he is more into this topic. I will ping him, once he is back from vacation.