In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospfteparseextlink for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "frr", "binary_version": "8.1-1ubuntu1.10" }, { "binary_name": "frr-dbgsym", "binary_version": "8.1-1ubuntu1.10" }, { "binary_name": "frr-doc", "binary_version": "8.1-1ubuntu1.10" }, { "binary_name": "frr-pythontools", "binary_version": "8.1-1ubuntu1.10" }, { "binary_name": "frr-rpki-rtrlib", "binary_version": "8.1-1ubuntu1.10" }, { "binary_name": "frr-rpki-rtrlib-dbgsym", "binary_version": "8.1-1ubuntu1.10" }, { "binary_name": "frr-snmp", "binary_version": "8.1-1ubuntu1.10" }, { "binary_name": "frr-snmp-dbgsym", "binary_version": "8.1-1ubuntu1.10" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "frr", "binary_version": "8.4.4-1.1ubuntu6.1" }, { "binary_name": "frr-dbgsym", "binary_version": "8.4.4-1.1ubuntu6.1" }, { "binary_name": "frr-doc", "binary_version": "8.4.4-1.1ubuntu6.1" }, { "binary_name": "frr-pythontools", "binary_version": "8.4.4-1.1ubuntu6.1" }, { "binary_name": "frr-rpki-rtrlib", "binary_version": "8.4.4-1.1ubuntu6.1" }, { "binary_name": "frr-rpki-rtrlib-dbgsym", "binary_version": "8.4.4-1.1ubuntu6.1" }, { "binary_name": "frr-snmp", "binary_version": "8.4.4-1.1ubuntu6.1" }, { "binary_name": "frr-snmp-dbgsym", "binary_version": "8.4.4-1.1ubuntu6.1" } ] }