CVE-2023-38802

HIGH

FRRouting FRR <9.0 - DoS

Title source: llm

Description

FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).

References (7)

[Exploit, Technical Description, Third Party Advisory] https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling

[Third Party Advisory] https://news.ycombinator.com/item?id=37305800

[Third Party Advisory] https://www.debian.org/security/2023/dsa-5495

[Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html

[Mailing List] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMJNX44SMJM25JZO7XWHDQCOB4SNJPIE/

[Mailing List] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JLG64IF3FU7V76K4TKCCXVNEE6P2VUDO/

[Mailing List] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXR6PIVY4SWO7HDT4EY733H4X32SCPM4/

Scores

CVSS v3 7.5

EPSS 0.0094

EPSS Percentile 76.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-354

Status published

Products (8)

debian/debian_linux 10.0

debian/debian_linux 11.0

debian/debian_linux 12.0

fedoraproject/fedora 37

fedoraproject/fedora 38

fedoraproject/fedora 39

frrouting/frrouting 7.5.1 - 9.0

pica8/picos 4.3.3.2

Published Aug 29, 2023

Tracked Since Feb 18, 2026