CVE-2023-38406: FRRouting Buffer Overflow Vulnerability

CVE-2023-38406 Overview

CVE-2023-38406 is a flowspec overflow vulnerability in FRRouting (FRR), an open-source internet routing protocol suite used in production networks. The flaw resides in bgpd/bgp_flowspec.c and stems from improper handling of a Network Layer Reachability Information (NLRI) length of zero. A remote attacker can send a crafted BGP FlowSpec message to a vulnerable bgpd daemon to trigger the condition. The vulnerability affects all FRR releases prior to 8.4.3 and is tracked under [CWE-755] (improper handling of exceptional conditions).

Critical Impact
A network-adjacent BGP peer can exploit the zero-length NLRI parsing flaw to compromise confidentiality, integrity, and availability of the routing daemon without authentication or user interaction.

Affected Products

FRRouting (FRR) versions before 8.4.3
Debian LTS distributions shipping vulnerable FRR packages
Network appliances and Linux distributions bundling FRR bgpd

Discovery Timeline

2023-11-06 - CVE-2023-38406 published to the National Vulnerability Database
2025-11-04 - Last updated in the NVD database

Technical Details for CVE-2023-38406

Vulnerability Analysis

The vulnerability exists in the FlowSpec NLRI parser implemented in bgpd/bgp_flowspec.c. The parser fails to validate that the NLRI length field is non-zero before processing subsequent fields. When a BGP UPDATE message contains a FlowSpec NLRI with a length of zero, the parser performs arithmetic and pointer operations against an empty buffer. This produces an out-of-bounds condition referred to in the upstream advisory as a "flowspec overflow."

FRR is widely deployed on Linux routers, software-defined networking gateways, and cloud infrastructure. Because bgpd runs as a privileged routing daemon and processes data sourced from BGP peers, any memory corruption inside the parser has direct operational and security consequences. The upstream fix is contained in the FRR 8.4.3 release, referenced by GitHub Pull Request #12884 and the FRR 8.4.2 to 8.4.3 comparison.

Root Cause

The root cause is missing input validation on the NLRI length attribute inside the FlowSpec decoder. The decoder assumes a positive length and proceeds to dereference and iterate without a guard for the zero case. This classifies the issue under [CWE-755] because the exceptional condition of an empty NLRI is not handled.

Attack Vector

Exploitation requires the ability to send BGP messages to a vulnerable bgpd instance. In typical deployments this means an established BGP session with the target, such as a misconfigured peer, a compromised neighbor router, or an exposed BGP listener. The attacker crafts a BGP UPDATE message carrying a FlowSpec NLRI with length zero. No authentication beyond standard BGP peering and no user interaction are required.

The vulnerability is described in prose only because no public proof-of-concept exploit code is referenced in the advisory. Refer to the upstream patch in PR #12884 for the precise code changes that add the missing length validation.

Detection Methods for CVE-2023-38406

Indicators of Compromise

Unexpected bgpd daemon crashes, restarts, or core dumps on FRR-based routers.
BGP session resets coincident with receipt of FlowSpec UPDATE messages from a specific peer.
Log entries from bgpd referencing FlowSpec NLRI parsing failures or assertion errors.

Detection Strategies

Inventory all hosts running FRR and identify versions below 8.4.3 using package management queries such as vtysh -c 'show version'.
Inspect BGP UPDATE traffic with packet capture tools for FlowSpec NLRI entries containing a length octet of zero.
Correlate routing daemon restart events with BGP neighbor activity in centralized log aggregation.

Monitoring Recommendations

Forward bgpd logs and process crash telemetry to a SIEM for alerting on abnormal restarts.
Monitor BGP peer stability metrics and alert on repeated session flaps from a single neighbor.
Track FRR package versions across the fleet to ensure remediated builds remain deployed.

How to Mitigate CVE-2023-38406

Immediate Actions Required

Upgrade FRR to version 8.4.3 or later on all systems running bgpd.
Apply Debian LTS updates for affected packages following the April 2024 advisory and the September 2024 advisory.
Audit BGP peer configurations and remove any unauthenticated or unnecessary FlowSpec-enabled peerings.

Patch Information

FRR 8.4.3 contains the fix introduced by Pull Request #12884. The change set is visible in the frr-8.4.2 to frr-8.4.3 comparison. Debian users should install the fixed packages published through the LTS announcements referenced above.

Workarounds

Disable BGP FlowSpec address-family processing where it is not operationally required, using no neighbor <peer> activate for the ipv4 flowspec and ipv6 flowspec address families.
Restrict BGP sessions to trusted peers using TCP-AO or MD5 authentication and infrastructure access control lists.
Place bgpd behind a network filter that blocks BGP traffic from untrusted sources until patching is complete.

bash

# Configuration example: disable FlowSpec address family on a BGP peer
router bgp 65001
 address-family ipv4 flowspec
  no neighbor 192.0.2.1 activate
 exit-address-family
 address-family ipv6 flowspec
  no neighbor 2001:db8::1 activate
 exit-address-family