CVE-2022-42917: FRRouting Privilege Escalation Vulnerability

CVE-2022-42917 Overview

CVE-2022-42917 is a local privilege escalation vulnerability in FRRouting (FRR) versions prior to 8.5. The service user (typically frr) can escalate privileges to root by monitoring the configuration directory /etc/frr and replacing configuration files upon creation with symlinks. This changes ownership of arbitrary files on the system. The flaw is a Time-of-Check Time-of-Use (TOCTOU) race condition [CWE-367] caused by a non-atomic combination of touch and chown operations in FRR's shell helper scripts.

Critical Impact
A low-privileged local user with access to the frr service account can obtain root ownership of arbitrary files, leading to full system compromise.

Affected Products

FRRouting FRR versions before 8.5
Linux distributions packaging FRR (including SUSE, per Bugzilla #1204124)
Routers and network appliances relying on FRR for BGP, OSPF, IS-IS, and related routing protocols

Discovery Timeline

2026-09-14 - CVE-2022-42917 published to the NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2022-42917

Vulnerability Analysis

FRRouting is a widely deployed open-source routing suite that runs under a dedicated unprivileged service account. The vulnerability resides in FRR's shell helper functions chownfrr() defined in tools/frr.in and tools/frrcommon.sh.in. These helpers create configuration files under /etc/frr using touch, then call chown, chgrp, and chmod as root to set ownership to the frr user and group.

Because file creation and ownership adjustment are not atomic, an attacker with control of the frr account can watch the directory and replace the freshly created file with a symlink before the chown executes. The privileged chown then follows the symlink and reassigns ownership of the target file to frr. Overwriting /etc/shadow, root-owned SSH keys, or a sudoers file yields root-equivalent access.

Root Cause

The root cause is a classic TOCTOU race between path lookup and privileged permission changes. The scripts trusted that a path created moments earlier still referred to the same inode, without using O_NOFOLLOW semantics or a single atomic operation to create and permission the file.

Attack Vector

Exploitation requires local access as the frr service user and user interaction such as a daemon restart or configuration reload that triggers file creation in /etc/frr. The attacker races the helper by monitoring the directory with inotify and swapping the target path for a symlink pointing at an arbitrary file owned by root.

text

# Vulnerable helper removed by the fix (tools/frr.in)
-chownfrr()
-{
-	test -n "$FRR_USER" && chown "$FRR_USER" "$1"
-	test -n "$FRR_GROUP" && chgrp "$FRR_GROUP" "$1"
-	test -n "$FRR_CONFIG_MODE" && chmod "$FRR_CONFIG_MODE" "$1"
-}

Source: GitHub Commit 972cdc5. The patch removes the touch/chown pattern and switches to install, which atomically sets ownership and mode at file creation time.

Detection Methods for CVE-2022-42917

Indicators of Compromise

Symbolic links appearing in /etc/frr that point to files outside the FRR configuration tree, such as /etc/shadow, /root/.ssh/authorized_keys, or /etc/sudoers.
Unexpected ownership changes on system files, with the target file now owned by the frr user or group.
Audit records showing chown or chmod executed by root against paths under /etc/frr immediately after activity by the frr UID.

Detection Strategies

Enable Linux auditd rules on /etc/frr to log open, openat, symlink, and symlinkat syscalls performed by the frr account.
Monitor for install, touch, and chown invocations spawned by frr.service, frrcommon.sh, or watchfrr and correlate with subsequent permission changes on non-FRR files.
Baseline the ownership of critical system files and alert on drift, especially transitions to the frr UID or GID.

Monitoring Recommendations

Deploy file integrity monitoring on /etc, /root, and /home to catch unauthorized ownership changes resulting from a successful race.
Track process lineage for daemons spawned by frr service scripts and flag any inotify-based watchers running under the frr account.
Alert on FRR service restarts and configuration reloads occurring outside change windows, since these events create the race opportunity.

How to Mitigate CVE-2022-42917

Immediate Actions Required

Upgrade FRRouting to version 8.5 or later on all routers, hosts, and appliances running the affected package.
Audit /etc/frr for existing symlinks pointing outside the directory and remove any that were not placed by administrators.
Restrict interactive shell access for the frr service account and revoke any secondary access that would let a low-privileged user act as frr.

Patch Information

The fix is delivered in FRR 8.5 through commit 972cdc5, which replaces the vulnerable chownfrr() helper with the install utility. install performs file creation with the correct owner, group, and mode in a single atomic operation, eliminating the TOCTOU window. Distribution-specific backports are tracked in the FRRouting CVE-2022-42917 advisory and the SUSE Bug Report #1204124. Full diff details are available in the FRRouting 8.4 to 8.5 comparison.

Workarounds

Tighten permissions on /etc/frr so that only root can create or rename entries within the directory while patching is scheduled.
Disable automatic configuration reloads and restart the FRR daemons only during controlled maintenance windows to reduce race opportunities.
Apply mandatory access control policies (AppArmor or SELinux) that prevent the frr account from creating symlinks under /etc/frr.

bash

# Restrict /etc/frr while awaiting the 8.5 upgrade
chown root:root /etc/frr
chmod 0755 /etc/frr

# Verify the FRR package version after upgrade
vtysh -c 'show version' | grep -i frr