rpms/frr
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Resolves: RHEL-174677 - denial of service via crafted FlowSpec component

Browse Source
This commit is contained in:
Michal Ruprich 2026-05-21 15:56:46 +02:00
parent 69a195683a
commit 1c3ac426f8
2 changed files with 53 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
0017-fix-CVE-2026-37457.patch Normal file
View File

@ -0,0 +1,48 @@
From c27757965a55e181b3f63239249bbd6ce249a082 Mon Sep 17 00:00:00 2001
From: Jafar Al-Gharaibeh <jafar@atcorp.com>
Date: Mon, 9 Mar 2026 14:36:22 -0500
Subject: [PATCH] bgpd: fix off-by-one error in FlowSpec operator array bounds
check
Change loop > BGP_PBR_MATCH_VAL_MAX to loop >= BGP_PBR_MATCH_VAL_MAX
in bgp_flowspec_op_decode() and bgp_flowspec_bitmask_decode() to
prevent writing one element past the end of the mval[] array when
more than 5 chained operators are present in a FlowSpec component.
Reported-by: Jiahao Lei
Signed-off-by: Jafar Al-Gharaibeh <jafar@atcorp.com>
---
bgpd/bgp_flowspec_util.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/bgpd/bgp_flowspec_util.c b/bgpd/bgp_flowspec_util.c
index 90e9236..4dd5034 100644
--- a/bgpd/bgp_flowspec_util.c
+++ b/bgpd/bgp_flowspec_util.c
@@ -266,8 +266,10 @@ int bgp_flowspec_op_decode(enum bgp_flowspec_util_nlri_t type,
*error = 0;
do {
- if (loop > BGP_PBR_MATCH_VAL_MAX)
+ if (loop >= BGP_PBR_MATCH_VAL_MAX) {
*error = -2;
+ return offset;
+ }
hex2bin(&nlri_ptr[offset], op);
offset++;
len = 2*op[2]+op[3];
@@ -370,8 +372,10 @@ int bgp_flowspec_bitmask_decode(enum bgp_flowspec_util_nlri_t type,
*error = 0;
do {
- if (loop > BGP_PBR_MATCH_VAL_MAX)
+ if (loop >= BGP_PBR_MATCH_VAL_MAX) {
*error = -2;
+ return offset;
+ }
hex2bin(&nlri_ptr[offset], op);
/* if first element, AND bit can not be set */
if (op[1] == 1 && loop == 0)
--
2.52.0

6
frr.spec
View File

@ -7,7 +7,7 @@
Name: frr
Version: 8.5.3
Release: 12%{?checkout}%{?dist}
Release: 13%{?checkout}%{?dist}
Summary: Routing daemon
License: GPLv2+
URL: http://www.frrouting.org
@ -80,6 +80,7 @@ Patch0013: 0013-bfd-bgp-recovery.patch
Patch0014: 0014-isisd-fuzz-test.patch
Patch0015: 0015-ipv6-wrong-hash.patch
Patch0016: 0016-dont-ignore-kernel-route.patch
Patch0017: 0017-fix-CVE-2026-37457.patch
%description
FRRouting is free software that manages TCP/IP based routing protocols. It takes
@ -287,6 +288,9 @@ make check PYTHON=%{__python3}
%endif
%changelog
* Thu May 21 2026 Michal Ruprich <mruprich@redhat.com> - 8.5.3-13
- Resolves: RHEL-174677 - denial of service via crafted FlowSpec component
* Fri Jan 16 2026 Michal Ruprich <mruprich@redhat.com> - 8.5.3-12
- Resolves: RHEL-137180 - Files under /var are not properly created in image-mode