CVE-2024-31950: FRRouting OSPF Buffer Overflow Vulnerability

CVE-2024-31950 Overview

CVE-2024-31950 is a buffer overflow vulnerability in FRRouting (FRR) through version 9.1. The flaw resides in the ospf_te_parse_ri function, which processes Open Shortest Path First (OSPF) Link State Advertisement (LSA) packets. When the daemon attempts to read Segment Routing subTLVs, it fails to validate their size, enabling an attacker to trigger a buffer overflow and crash the OSPF daemon. FRRouting is a widely deployed open-source routing stack used in network appliances, Linux distributions, and container-based networking fabrics, making the OSPF service a reachable attack surface in many enterprise environments.

Critical Impact
A remote attacker can send a crafted OSPF LSA packet to trigger a buffer overflow in the OSPF daemon, resulting in a crash and routing disruption.

Affected Products

FRRouting (FRR) versions through 9.1
Linux distributions bundling vulnerable FRR packages
Network operating systems and appliances embedding FRR as the routing stack

Discovery Timeline

2024-04-07 - CVE-2024-31950 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31950

Vulnerability Analysis

The vulnerability affects the ospf_te_parse_ri function in the OSPF Traffic Engineering (TE) subsystem of FRRouting. This function parses the Router Information (RI) opaque LSA, which carries Segment Routing capability subTLVs used by SR-enabled OSPF deployments. When processing incoming LSAs, the parser reads subTLV length fields without validating them against the remaining buffer size. A crafted subTLV with an oversized or malformed length value causes the parser to read or write past the allocated buffer boundary. The result is a memory corruption condition that terminates the ospfd daemon, breaking OSPF adjacencies and triggering route recalculation across the affected routing domain.

Root Cause

The root cause is classified under [CWE-120] (Buffer Copy without Checking Size of Input). The ospf_te_parse_ri routine trusts length values embedded in Segment Routing subTLVs instead of enforcing bounds checks against the LSA payload. This missing input validation allows attacker-controlled length fields to drive memory access beyond the intended buffer.

Attack Vector

Exploitation requires the attacker to deliver a malicious OSPF LSA to a vulnerable ospfd instance. Because OSPF typically runs on trusted interior networks, the attacker needs either Layer 2/3 adjacency to a target router or the ability to inject packets into the routing domain. Successful exploitation crashes the daemon, producing a denial-of-service condition against routing availability. The upstream fix was merged in FRRouting Pull Request #15674, which adds explicit size validation for Segment Routing subTLVs in commit 6b84541.

Detection Methods for CVE-2024-31950

Indicators of Compromise

Unexpected ospfd daemon crashes or restarts recorded in system logs or systemd journal entries
Core dump files generated by the FRR ospfd process
OSPF adjacency flaps and sudden route table recomputations on routers running FRR
Receipt of malformed OSPF Opaque LSAs containing oversized Segment Routing subTLV length fields

Detection Strategies

Monitor FRR daemon lifecycle events and correlate ospfd termination with inbound OSPF traffic
Inspect OSPF Opaque LSAs (type 9/10/11) carrying Router Information TLVs for subTLV length values exceeding the enclosing LSA size
Deploy network IDS signatures that flag malformed OSPF Router Information LSAs on routed interfaces

Monitoring Recommendations

Alert on repeated OSPF adjacency state changes and LSA retransmissions originating from a single neighbor
Forward FRR logs to a centralized logging platform and build detections for ospfd segfaults and watchdog restarts
Baseline the normal set of Segment Routing capable OSPF speakers so that unexpected senders of SR subTLVs are flagged for review

How to Mitigate CVE-2024-31950

Immediate Actions Required

Upgrade FRRouting to a patched release that incorporates the fix from FRR PR #15674
Audit routers for exposed OSPF interfaces facing untrusted segments and restrict adjacency formation to known peers
Enable OSPF cryptographic authentication (ip ospf authentication message-digest) on all adjacencies to prevent LSA injection from unauthorized sources

Patch Information

The upstream fix is included in commit 6b84541df71772f697a7f9e6b2aaf72536aab775, which adds size validation for Segment Routing subTLVs within ospf_te_parse_ri. Operators should apply vendor-provided updates for FRR packages shipped with their Linux distribution or network OS, or rebuild from a patched FRR source tree beyond version 9.1.

Workarounds

Disable OSPF Segment Routing extensions where they are not required by the deployment
Apply OSPF MD5 or HMAC-SHA authentication on all participating interfaces to reject unauthenticated LSAs
Restrict OSPF protocol traffic at network boundaries using access control lists so only trusted router interfaces can originate LSAs
Isolate management and routing control planes from user-reachable network segments

bash

# Enable OSPF message-digest authentication on an FRR interface
vtysh -c "configure terminal" \
      -c "interface eth0" \
      -c "ip ospf authentication message-digest" \
      -c "ip ospf message-digest-key 1 md5 <strong-shared-secret>" \
      -c "end" \
      -c "write memory"