CVE-2024-27913

Executive Summary

CVE-2024-27913 is a denial-of-service (DoS) vulnerability in FRRouting (FRR) through version 9.1, specifically in the ospf_te_parse_te function within ospfd/ospf_te.c. A remote, unauthenticated attacker can trigger a crash of the ospfd daemon by sending a malformed OSPF LSA packet that attempts to access a missing attribute field. This vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as high severity due to the potential for network disruption. No public exploit code or proof-of-concept is available at this time.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; a malformed packet is sufficient.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is altered.
• Availability (A): High (H) – The ospfd daemon crashes, causing a denial of service.

Threat Level: High – Exploitation can disrupt OSPF routing, leading to network instability.

Deep Dive & Mechanics

The vulnerability resides in the ospf_te_parse_te function in ospfd/ospf_te.c. This function is responsible for parsing OSPF Traffic Engineering (TE) Link State Advertisements (LSAs). When processing a malformed LSA packet, the code attempts to access an attribute field that is missing or improperly formatted. This results in a NULL pointer dereference or an out-of-bounds read, causing the ospfd daemon to crash.

The root cause is insufficient validation of the LSA packet structure before accessing specific fields. An attacker can craft a packet that omits or corrupts the expected attribute, leading to a segmentation fault.

Vulnerable vs. Patched Code

Vulnerable Code (FRR <= 9.1):

// ospfd/ospf_te.c
static int ospf_te_parse_te(struct ospf_lsa *lsa)
{
    struct te_tlv_header *tlv;
    // ... parsing logic ...
    // Missing check for tlv->length before accessing tlv->value
    if (tlv->type == TE_TLV_SUBTLV) {
        // Direct access without validation
        struct te_subtlv *sub = (struct te_subtlv *)tlv->value;
        // ...
    }
    // ...
}

Patched Code (Hypothetical):

// ospfd/ospf_te.c
static int ospf_te_parse_te(struct ospf_lsa *lsa)
{
    struct te_tlv_header *tlv;
    // ... parsing logic ...
    // Added length validation
    if (tlv->type == TE_TLV_SUBTLV) {
        if (tlv->length < sizeof(struct te_subtlv)) {
            // Log error and skip malformed TLV
            zlog_warn("Malformed TE TLV: length %u too small", tlv->length);
            return -1;
        }
        struct te_subtlv *sub = (struct te_subtlv *)tlv->value;
        // ...
    }
    // ...
}

Exploitation & Lab Setup

Red Team

1. Environment Setup:

   • Deploy FRR 9.1 on a Linux host (e.g., Ubuntu 22.04).
   • Configure OSPF with TE extensions enabled.
   • Use a tool like scapy to craft malformed OSPF LSA packets.

2. Exploitation Steps:

   • Identify the target OSPF router's IP address.
   • Craft a malformed OSPF LSA packet with a missing or truncated TE attribute field.
   • Send the packet to the target's OSPF port (port 179).
   • Monitor the ospfd daemon for crashes (e.g., using systemctl status ospfd).

3. Example Scapy Script:

   from scapy.all import *
   import struct
   
   # Craft a malformed OSPF LSA with TE TLV missing length
   packet = IP(dst="192.168.1.1")/OSPF_Hdr()/OSPF_LS_Update(lsa=[OSPF_LSA()])
   # Inject malformed TE data
   raw_data = struct.pack("!HH", 1, 0)  # Type=1, Length=0 (invalid)
   packet[OSPF_LSA].data = raw_data
   send(packet)
   

Blue Team

1. Detection:

   • Monitor OSPF packets for anomalies using network intrusion detection systems (NIDS).
   • Look for OSPF LSAs with unexpected TLV lengths or missing attributes.

2. Mitigation:

   • Apply access control lists (ACLs) to restrict OSPF peering to trusted IP addresses.
   • Use authentication for OSPF exchanges (e.g., MD5 or SHA authentication).
   • Deploy a firewall to block unauthorized OSPF packets.

3. Forensics:

   • Capture OSPF traffic for analysis using tcpdump or wireshark.
   • Check ospfd logs for crash indicators (e.g., segmentation fault).

Indicators of Compromise (IOCs)

• Network IOCs:
  • OSPF packets with malformed TE TLVs (e.g., TLV length field set to 0 or inconsistent with actual data).
  • Repeated OSPF LSAs from a single source with unusual TLV structures.
• System IOCs:
  • ospfd daemon crashes (segmentation fault) logged in /var/log/syslog or journalctl.
  • Core dump files from ospfd in /var/crash/.
• File IOCs:
  • Modified ospfd/ospf_te.c source file (if patched).

Detection Engineering

YARA Rule

rule CVE_2024_27913_OSPF_TE_Malformed {
    meta:
        description = "Detects malformed OSPF TE LSA packets targeting CVE-2024-27913"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-27913"
    strings:
        $ospf_header = { 02 ?? ?? ?? }  // OSPF version 2
        $te_tlv_type = { 00 01 }        // TE TLV type
        $te_tlv_len_zero = { 00 00 }    // TE TLV length zero
    condition:
        $ospf_header and $te_tlv_type and $te_tlv_len_zero
}

Sigma Rule

title: CVE-2024-27913 OSPF TE Malformed Packet Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects malformed OSPF TE LSA packets that may trigger CVE-2024-27913
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_protocol: ospf
        packet_data|contains: "0001"  # TE TLV type
        packet_data|contains: "0000"  # TE TLV length zero
    condition: selection
falsepositives:
    - Legitimate OSPF TE packets with zero-length TLVs (rare)
level: high

Suricata Rule

alert ospf any any -> any any (msg:"CVE-2024-27913 OSPF TE Malformed LSA"; content:"|02|"; offset:0; depth:1; content:"|00 01|"; distance:0; within:2; content:"|00 00|"; distance:0; within:2; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Upgrade FRRouting to version 9.2 or later if a patch becomes available.
   • If patching is not possible, disable OSPF TE extensions on vulnerable routers.
   • Restrict OSPF peering to trusted IP addresses using ACLs.

2. Long-term Measures:

   • Implement OSPF authentication (MD5 or SHA) to prevent unauthorized packet injection.
   • Deploy network intrusion detection systems (NIDS) to monitor for malformed OSPF packets.
   • Regularly update FRRouting to the latest stable version.

3. Workarounds:

   • Use firewall rules to block OSPF traffic from untrusted networks.
   • Monitor ospfd logs for crashes and restart the daemon automatically (e.g., using systemd restart policies).

Valters IT
Securing Networks, One Packet at a Time