[USN-7230-2] FRR vulnerabilities

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEyMDHOTG0YH5UsajI8pSCVQZYHygFAmeYJ7cFAwAAAAAACgkQ8pSCVQZYHyjB
NQ//UjQ2WqhuwuS8oAuTPdT8VjbqvS3U0ow0osbJkYfyboYJmWyRbD/s187dPIkkH65l7vPARJud
tfRxscVMWMc/pvvQKxkeJsucurqdmtc6C5Fnihc9xwlDQgI2k+N2cXzitI35h57A+frJwGs7ScmM
9+ATZlWkcg31OM2bThmnfc7AL8C9cVyv4QtdIy7sbTomizED1a1Nm4RsEWgJ+HAeHFWyZdPeudr5
xIq3v5VmI8ZjMEQFor9NplI2WZ2w/EW+MWpTqdUpKi87cnnlX5jszh3WBxdpx2aUclqGaCAOz2qg
T3d4pghf7RxlV5Wyzo11D/Sg5Di/MyCJXcmjfatLgDZp2k39xF3B4SCmb0nQr5lslJzAqfLt/dpW
WkqoHQnCWRqwTMiQ6VX3Om7DCNYCl3v1bxiCivnHhapa52r5+vEhZDmo7dMEAzq2kQ8XOZpX2x7d
rWQFRVCKXf6Tx8kmDbfbRn2jJfz2aV95rAA1qBho7Y9M9K2H8+OzvlFQ/mEIjNzWg00y9CXjGwz8
+C2vnMfsscjabiZ18sOieQ4VtqdrVuibnxMknyv3nvW/j8pe9f7t4x9yDHR8BQTd/X89wJhSRPT2
YZ0Hj2T8cTKUp+wcmKV6oFFTQ81tXJQMH9t5c80Hu/QlQqoDVsRBjnkPkZS3b4qy4V3pYeMrfur6
1pI=
=IQYt
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7230-2
January 27, 2025

frr vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

FRR could be made to crash or exhibit degraded performance if it received
specially crafted network traffic.

Software Description:
- frr: FRRouting suite of internet protocols

Details:

Iggy Frankovic discovered that FRR incorrectly handled certain BGP
messages. A remote attacker could possibly use this issue to cause FRR to
crash, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS. (CVE-2024-44070)

It was discovered that FRR re-validated all routes in certain instances
when the internal socket's buffer size overflowed. A remote attacker could
possibly use this issue to impact the performance of FRR, resulting in a
denial of service. (CVE-2024-55553)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.10
  frr                             10.0.1-0.1ubuntu3

Ubuntu 24.04 LTS
  frr                             8.4.4-1.1ubuntu6.3

Ubuntu 22.04 LTS
  frr                             8.1-1ubuntu1.13

Ubuntu 20.04 LTS
  frr                             7.2.1-1ubuntu0.2+esm3
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7230-2
  https://ubuntu.com/security/notices/USN-7230-1
  CVE-2024-44070, CVE-2024-55553

Package Information:
  https://launchpad.net/ubuntu/+source/frr/10.0.1-0.1ubuntu3
  https://launchpad.net/ubuntu/+source/frr/8.4.4-1.1ubuntu6.3
  https://launchpad.net/ubuntu/+source/frr/8.1-1ubuntu1.13