From c859edd6ca65f987b2f72bfd8d89900608076e4f Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Tue, 21 Jul 2026 11:34:44 +0000 Subject: [PATCH] Fix CVE-2026-37460: EVPN and ENCAP/VNC packet parsing validation Backport upstream commit 7676cad65114 to fix CVE-2026-37460. The patch adds input validation for EVPN Type-2/3/4 NLRIs in bgp_evpn.c and bgp_evpn_mh.c, and validates ENCAP/VNC subtlv lengths in rfapi_rib.c to prevent crashes from crafted BGP UPDATE messages. CVE: CVE-2026-37460 Upstream patches: - https://github.com/FRRouting/frr/commit/7676cad65114aa23adde583d91d9d29e2debd045.patch Resolves: RHEL-193235 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- 0020-fix-CVE-2026-37460.patch | 97 +++++++++++++++++++++++++++++++++++ frr.spec | 7 ++- 2 files changed, 103 insertions(+), 1 deletion(-) create mode 100644 0020-fix-CVE-2026-37460.patch diff --git a/0020-fix-CVE-2026-37460.patch b/0020-fix-CVE-2026-37460.patch new file mode 100644 index 0000000..d44c265 --- /dev/null +++ b/0020-fix-CVE-2026-37460.patch @@ -0,0 +1,97 @@ +From 7c9a8cfc48b61708b758f9d0e3445f64c225e914 Mon Sep 17 00:00:00 2001 +From: Mark Stapp +Date: Wed, 11 Mar 2026 14:52:54 -0400 +Subject: [PATCH] bgpd: improve packet parsing for EVPN and ENCAP/VNC + +Improve packet validation for EVPN NLRIs and for ENCAP/VNC. + +Signed-off-by: Mark Stapp +--- + bgpd/bgp_evpn.c | 17 +++++++++++++++++ + bgpd/bgp_evpn_mh.c | 10 +++++++++- + bgpd/rfapi/rfapi_rib.c | 9 +++++++++ + 3 files changed, 35 insertions(+), 1 deletion(-) + +diff --git a/bgpd/bgp_evpn.c b/bgpd/bgp_evpn.c +index 2b2cfa0f4..e45bd46bf 100644 +--- a/bgpd/bgp_evpn.c ++++ b/bgpd/bgp_evpn.c +@@ -4505,6 +4505,14 @@ static int process_type2_route(struct peer *peer, afi_t afi, safi_t safi, + goto fail; + } + ++ /* Validate ipaddr_len against the NLRI length */ ++ if ((psize != 33 + (ipaddr_len / 8)) && (psize != 36 + (ipaddr_len / 8))) { ++ flog_err(EC_BGP_EVPN_ROUTE_INVALID, ++ "%u:%s - Rx EVPN Type-2 NLRI with invalid IP address length %d", ++ peer->bgp->vrf_id, peer->host, ipaddr_len); ++ goto fail; ++ } ++ + if (ipaddr_len) { + ipaddr_len /= 8; /* Convert to bytes. */ + p.prefix.macip_addr.ip.ipa_type = (ipaddr_len == IPV4_MAX_BYTELEN) +@@ -4603,6 +4611,15 @@ static int process_type3_route(struct peer *peer, afi_t afi, safi_t safi, + + /* Get the IP. */ + ipaddr_len = *pfx++; ++ ++ /* Validate */ ++ if (psize != 13 + (ipaddr_len / 8)) { ++ flog_err(EC_BGP_EVPN_ROUTE_INVALID, ++ "%u:%s - Rx EVPN Type-3 NLRI with invalid IP address length %d", ++ peer->bgp->vrf_id, peer->host, ipaddr_len); ++ return -1; ++ } ++ + if (ipaddr_len == IPV4_MAX_BITLEN) { + p.prefix.imet_addr.ip.ipa_type = IPADDR_V4; + memcpy(&p.prefix.imet_addr.ip.ip.addr, pfx, IPV4_MAX_BYTELEN); +diff --git a/bgpd/bgp_evpn_mh.c b/bgpd/bgp_evpn_mh.c +index 552365959..548e9defe 100644 +--- a/bgpd/bgp_evpn_mh.c ++++ b/bgpd/bgp_evpn_mh.c +@@ -733,9 +733,17 @@ int bgp_evpn_type4_route_process(struct peer *peer, afi_t afi, safi_t safi, + memcpy(&esi, pfx, ESI_BYTES); + pfx += ESI_BYTES; + +- + /* Get the IP. */ + ipaddr_len = *pfx++; ++ ++ /* Validate */ ++ if (psize != 19 + (ipaddr_len / 8)) { ++ flog_err(EC_BGP_EVPN_ROUTE_INVALID, ++ "%u:%s - Rx EVPN Type-4 NLRI with invalid IP address length %d", ++ peer->bgp->vrf_id, peer->host, ipaddr_len); ++ return -1; ++ } ++ + if (ipaddr_len == IPV4_MAX_BITLEN) { + memcpy(&vtep_ip, pfx, IPV4_MAX_BYTELEN); + } else { +diff --git a/bgpd/rfapi/rfapi_rib.c b/bgpd/rfapi/rfapi_rib.c +index a9c0c026e..71fcab0c3 100644 +--- a/bgpd/rfapi/rfapi_rib.c ++++ b/bgpd/rfapi/rfapi_rib.c +@@ -648,11 +648,20 @@ static void rfapiRibBi2Ri(struct bgp_path_info *bpi, struct rfapi_info *ri, + break; + + case BGP_VNC_SUBTLV_TYPE_RFPOPTION: ++ /* Check for short subtlv: drop */ ++ if (pEncap->length < 3) ++ break; ++ ++ /* Length of zero not valid */ ++ if (pEncap->value[1] == 0) ++ break; ++ + hop = XCALLOC(MTYPE_BGP_TEA_OPTIONS, + sizeof(struct bgp_tea_options)); + assert(hop); + hop->type = pEncap->value[0]; + hop->length = pEncap->value[1]; ++ + hop->value = XCALLOC(MTYPE_BGP_TEA_OPTIONS_VALUE, + pEncap->length - 2); + assert(hop->value); diff --git a/frr.spec b/frr.spec index e988206..db1dfbd 100644 --- a/frr.spec +++ b/frr.spec @@ -7,7 +7,7 @@ Name: frr Version: 8.5.3 -Release: 15%{?checkout}%{?dist} +Release: 16%{?checkout}%{?dist} Summary: Routing daemon License: GPLv2+ URL: http://www.frrouting.org @@ -83,6 +83,7 @@ Patch0016: 0016-dont-ignore-kernel-route.patch Patch0017: 0017-fix-CVE-2026-37457.patch Patch0018: 0018-ignored-int-after-flapping.patch Patch0019: 0019-set-pythonnouser-env-var.patch +Patch0020: 0020-fix-CVE-2026-37460.patch %description FRRouting is free software that manages TCP/IP based routing protocols. It takes @@ -290,6 +291,10 @@ make check PYTHON=%{__python3} %endif %changelog +* Tue Jul 21 2026 RHEL Packaging Agent - 8.5.3-16 +- Resolves: RHEL-193235 - CVE-2026-37460 frr: invalid EVPN/ENCAP packet + parsing in bgpd + * Fri Jul 03 2026 Michal Ruprich - 8.5.3-15 - Resolves: RHEL-176258 - AVC when reading user's site-packages