CVE-2022-37035

An issue was discovered in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c, there is a possible use-after-free due to a race condition. This could lead to Remote Code Execution or Information Disclosure by sending crafted BGP packets. User interaction is not needed for exploitation.

Database specific

{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37035.json"
}

References

Affected packages

Git / github.com/frrouting/frr

Affected ranges

Type

GIT

Repo

https://github.com/frrouting/frr

Events

Introduced

aa800819cde613f296a38228642463477fcf7c12

Last Affected

aa800819cde613f296a38228642463477fcf7c12

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:frrouting:frrouting:8.3:-:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "8.3-NA"
                },
                {
                    "last_affected":  "8.3-NA"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

8.*

8.3-NA

base_8.*

base_8.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37035.json"