Ubuntu alert USN-7230-2 (frr)

From:
             
 
John Breton <john.breton@canonical.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7230-2] FRR vulnerabilities
Date:
             
 
Mon, 27 Jan 2025 19:41:27 -0500
Message-ID:
             
 
<31cd68c4-ffe1-4089-ba98-2683ebf3546d@canonical.com>
==========================================================================
Ubuntu Security Notice USN-7230-2
January 27, 2025

frr vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

FRR could be made to crash or exhibit degraded performance if it received
specially crafted network traffic.

Software Description:
- frr: FRRouting suite of internet protocols

Details:

Iggy Frankovic discovered that FRR incorrectly handled certain BGP
messages. A remote attacker could possibly use this issue to cause FRR to
crash, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS. (CVE-2024-44070)

It was discovered that FRR re-validated all routes in certain instances
when the internal socket's buffer size overflowed. A remote attacker could
possibly use this issue to impact the performance of FRR, resulting in a
denial of service. (CVE-2024-55553)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.10
   frr                             10.0.1-0.1ubuntu3

Ubuntu 24.04 LTS
   frr                             8.4.4-1.1ubuntu6.3

Ubuntu 22.04 LTS
   frr                             8.1-1ubuntu1.13

Ubuntu 20.04 LTS
   frr                             7.2.1-1ubuntu0.2+esm3
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-7230-2
   https://ubuntu.com/security/notices/USN-7230-1
   CVE-2024-44070, CVE-2024-55553

Package Information:
   https://launchpad.net/ubuntu/+source/frr/10.0.1-0.1ubuntu3
   https://launchpad.net/ubuntu/+source/frr/8.4.4-1.1ubuntu6.3
   https://launchpad.net/ubuntu/+source/frr/8.1-1ubuntu1.13



Attachment: OpenPGP_signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEyMDHOTG0YH5UsajI8pSCVQZYHygFAmeYJ7cFAwAAAAAACgkQ8pSCVQZYHyjB
NQ//UjQ2WqhuwuS8oAuTPdT8VjbqvS3U0ow0osbJkYfyboYJmWyRbD/s187dPIkkH65l7vPARJud
tfRxscVMWMc/pvvQKxkeJsucurqdmtc6C5Fnihc9xwlDQgI2k+N2cXzitI35h57A+frJwGs7ScmM
9+ATZlWkcg31OM2bThmnfc7AL8C9cVyv4QtdIy7sbTomizED1a1Nm4RsEWgJ+HAeHFWyZdPeudr5
xIq3v5VmI8ZjMEQFor9NplI2WZ2w/EW+MWpTqdUpKi87cnnlX5jszh3WBxdpx2aUclqGaCAOz2qg
T3d4pghf7RxlV5Wyzo11D/Sg5Di/MyCJXcmjfatLgDZp2k39xF3B4SCmb0nQr5lslJzAqfLt/dpW
WkqoHQnCWRqwTMiQ6VX3Om7DCNYCl3v1bxiCivnHhapa52r5+vEhZDmo7dMEAzq2kQ8XOZpX2x7d
rWQFRVCKXf6Tx8kmDbfbRn2jJfz2aV95rAA1qBho7Y9M9K2H8+OzvlFQ/mEIjNzWg00y9CXjGwz8
+C2vnMfsscjabiZ18sOieQ4VtqdrVuibnxMknyv3nvW/j8pe9f7t4x9yDHR8BQTd/X89wJhSRPT2
YZ0Hj2T8cTKUp+wcmKV6oFFTQ81tXJQMH9t5c80Hu/QlQqoDVsRBjnkPkZS3b4qy4V3pYeMrfur6
1pI=
=IQYt
-----END PGP SIGNATURE-----


Attachment: None (type=text/plain)