rpms/frr10
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-37460: improve packet parsing for EVPN and ENCAP/VNC

Browse Source 
Resolves: RHEL-193237
This commit is contained in:
Michal Ruprich 2026-07-21 16:04:14 +02:00
parent fbfb307843
commit 07baefd9dd
2 changed files with 104 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

97
0017-fix-CVE-2026-37460.patch Normal file
View File

@ -0,0 +1,97 @@
From bbb2a8a4c25957b1920f03571c0e43f21fbe9736 Mon Sep 17 00:00:00 2001
From: Mark Stapp <mjs@cisco.com>
Date: Wed, 11 Mar 2026 14:52:54 -0400
Subject: [PATCH] bgpd: improve packet parsing for EVPN and ENCAP/VNC
Improve packet validation for EVPN NLRIs and for ENCAP/VNC.
Signed-off-by: Mark Stapp <mjs@cisco.com>
---
bgpd/bgp_evpn.c | 17 +++++++++++++++++
bgpd/bgp_evpn_mh.c | 10 +++++++++-
bgpd/rfapi/rfapi_rib.c | 9 +++++++++
3 files changed, 35 insertions(+), 1 deletion(-)
diff --git a/bgpd/bgp_evpn.c b/bgpd/bgp_evpn.c
index a8fa99fcd..ef9e607ab 100644
--- a/bgpd/bgp_evpn.c
+++ b/bgpd/bgp_evpn.c
@@ -4984,6 +4984,14 @@ static int process_type2_route(struct peer *peer, afi_t afi, safi_t safi,
goto fail;
}
+ /* Validate ipaddr_len against the NLRI length */
+ if ((psize != 33 + (ipaddr_len / 8)) && (psize != 36 + (ipaddr_len / 8))) {
+ flog_err(EC_BGP_EVPN_ROUTE_INVALID,
+ "%u:%s - Rx EVPN Type-2 NLRI with invalid IP address length %d",
+ peer->bgp->vrf_id, peer->host, ipaddr_len);
+ goto fail;
+ }
+
if (ipaddr_len) {
ipaddr_len /= 8; /* Convert to bytes. */
p.prefix.macip_addr.ip.ipa_type = (ipaddr_len == IPV4_MAX_BYTELEN)
@@ -5081,6 +5089,15 @@ static int process_type3_route(struct peer *peer, afi_t afi, safi_t safi,
/* Get the IP. */
ipaddr_len = *pfx++;
+
+ /* Validate */
+ if (psize != 13 + (ipaddr_len / 8)) {
+ flog_err(EC_BGP_EVPN_ROUTE_INVALID,
+ "%u:%s - Rx EVPN Type-3 NLRI with invalid IP address length %d",
+ peer->bgp->vrf_id, peer->host, ipaddr_len);
+ return -1;
+ }
+
if (ipaddr_len == IPV4_MAX_BITLEN) {
p.prefix.imet_addr.ip.ipa_type = IPADDR_V4;
memcpy(&p.prefix.imet_addr.ip.ip.addr, pfx, IPV4_MAX_BYTELEN);
diff --git a/bgpd/bgp_evpn_mh.c b/bgpd/bgp_evpn_mh.c
index f03678af6..71b2ba0b2 100644
--- a/bgpd/bgp_evpn_mh.c
+++ b/bgpd/bgp_evpn_mh.c
@@ -752,9 +752,17 @@ int bgp_evpn_type4_route_process(struct peer *peer, afi_t afi, safi_t safi,
memcpy(&esi, pfx, ESI_BYTES);
pfx += ESI_BYTES;
-
/* Get the IP. */
ipaddr_len = *pfx++;
+
+ /* Validate */
+ if (psize != 19 + (ipaddr_len / 8)) {
+ flog_err(EC_BGP_EVPN_ROUTE_INVALID,
+ "%u:%s - Rx EVPN Type-4 NLRI with invalid IP address length %d",
+ peer->bgp->vrf_id, peer->host, ipaddr_len);
+ return -1;
+ }
+
if (ipaddr_len == IPV4_MAX_BITLEN) {
memcpy(&vtep_ip, pfx, IPV4_MAX_BYTELEN);
} else {
diff --git a/bgpd/rfapi/rfapi_rib.c b/bgpd/rfapi/rfapi_rib.c
index 9a3d56b06..11384b51c 100644
--- a/bgpd/rfapi/rfapi_rib.c
+++ b/bgpd/rfapi/rfapi_rib.c
@@ -668,11 +668,20 @@ static void rfapiRibBi2Ri(struct bgp_path_info *bpi, struct rfapi_info *ri,
break;
case BGP_VNC_SUBTLV_TYPE_RFPOPTION:
+ /* Check for short subtlv: drop */
+ if (pEncap->length < 3)
+ break;
+
+ /* Length of zero not valid */
+ if (pEncap->value[1] == 0)
+ break;
+
hop = XCALLOC(MTYPE_BGP_TEA_OPTIONS,
sizeof(struct bgp_tea_options));
assert(hop);
hop->type = pEncap->value[0];
hop->length = pEncap->value[1];
+
hop->value = XCALLOC(MTYPE_BGP_TEA_OPTIONS_VALUE,
pEncap->length - 2);
assert(hop->value);

8
frr10.spec
View File

@ -8,7 +8,7 @@
Name: frr10
Version: 10.4.3
Release: 3%{?checkout}%{?dist}
Release: 4%{?checkout}%{?dist}
Summary: Routing daemon
License: GPLv2+
URL: http://www.frrouting.org
@ -77,6 +77,8 @@ Patch0014: 0014-isisd-fuzz-test.patch
Patch0015: 0015-fix-CVE-2026-37457.patch
# https://github.com/FRRouting/frr/commit/693a2e02
Patch0016: 0016-fix-CVE-2026-37459.patch
# https://github.com/FRRouting/frr/commit/7676cad65114aa23adde58
Patch0017: 0017-fix-CVE-2026-37460.patch
%description
FRRouting is free software that manages TCP/IP based routing protocols. It takes
@ -285,6 +287,10 @@ make check PYTHON=%{__python3}
%endif
%changelog
* Tue Jul 21 2026 Michal Ruprich <mruprich@redhat.com> - 10.4.3-4
- Fix CVE-2026-37460: improve packet parsing for EVPN and ENCAP/VNC
- Resolves: RHEL-193237
* Thu May 21 2026 Michal Ruprich <mruprich@redhat.com> - 10.4.3-3
- Resolves: RHEL-174696 - denial of service via crafted BGP UPDATE message