CVE-2024-44070 Overview
CVE-2024-44070 is a denial-of-service vulnerability in FRRouting (FRR) through version 10.1. The flaw resides in the bgp_attr_encap function within bgpd/bgp_attr.c. The function fails to check the actual remaining stream length before reading the TLV (Type-Length-Value) value. A remote, unauthenticated attacker can send a crafted BGP UPDATE message that triggers an out-of-bounds read, crashing the bgpd daemon. FRRouting is deployed on Linux platforms including Red Hat Enterprise Linux 8 and 9, and disruption of the daemon breaks routing on affected devices.
Critical Impact
A network-adjacent BGP peer can crash the bgpd process without authentication, disrupting routing and causing sustained denial of service across affected FRR deployments.
Affected Products
- FRRouting FRR through version 10.1
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Discovery Timeline
- 2024-08-19 - CVE-2024-44070 published to NVD
- 2024-09 - Debian LTS security announcement released
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-44070
Vulnerability Analysis
The vulnerability affects the BGP daemon (bgpd) shipped with FRRouting, an open-source routing suite widely deployed on Linux-based routers and data-center fabrics. The bgp_attr_encap function processes encapsulation attributes encoded as TLV structures inside BGP UPDATE messages. The parser reads the length field from the incoming stream and then proceeds to read that many bytes of value data. It does not verify that the declared TLV length fits within the remaining bytes of the attribute stream. When the length exceeds the actual data available, the parser reads past the buffer boundary or triggers a fatal assertion, causing the daemon to terminate. Because BGP sessions are established with configured peers, an attacker who controls or compromises any peer can trigger the crash. Repeated exploitation prevents session recovery, sustaining the outage.
Root Cause
The root cause is missing input validation in the TLV parsing logic of bgp_attr_encap. The function trusts the length field supplied by the remote peer without cross-checking it against the actual stream length. This is a classic bounds-check omission preceding an out-of-bounds read. See the upstream fix in the FRRouting pull request #16497 for the corrected length validation.
Attack Vector
Exploitation requires an established BGP session with the target bgpd instance. An attacker sends a malformed BGP UPDATE containing an encapsulation attribute with a TLV length that exceeds the remaining attribute payload. Parsing the malformed attribute causes bgpd to crash, terminating all BGP sessions on the device and withdrawing advertised routes. The vulnerability does not require authentication beyond the standard BGP peering relationship and does not require user interaction. No proof-of-concept exploit is publicly listed at this time, and the CVE is not present on the CISA Known Exploited Vulnerabilities catalog.
No verified public exploit code is available. Refer to the Debian LTS Security Announcement for packaging details.
Detection Methods for CVE-2024-44070
Indicators of Compromise
- Unexpected bgpd process termination or repeated restarts logged by the service manager (systemd or equivalent).
- BGP session flaps or peer resets originating from a single upstream neighbor without a configuration change.
- Core dumps or segmentation fault entries referencing bgp_attr_encap in bgpd/bgp_attr.c.
Detection Strategies
- Monitor bgpd logs for parser errors related to encapsulation attributes and abnormal termination messages.
- Alert on BGP neighbor state transitions to Idle or Active states that correlate with process crashes.
- Inspect packet captures on BGP TCP port 179 for UPDATE messages containing encapsulation attributes with inconsistent length fields.
Monitoring Recommendations
- Enable process supervision and crash telemetry for bgpd and forward events to a centralized logging platform.
- Track BGP session uptime and route churn metrics to identify sustained availability impact.
- Correlate router availability alerts with upstream peer identity to isolate the source of malformed updates.
How to Mitigate CVE-2024-44070
Immediate Actions Required
- Upgrade FRRouting to a patched release beyond 10.1 that includes the fix from FRRouting PR #16497.
- Apply the FRR package update from Red Hat and Debian repositories for affected distributions.
- Restrict BGP peering to authenticated, trusted neighbors and enforce TCP MD5 or TCP-AO authentication.
Patch Information
The FRRouting maintainers merged the fix through pull request #16497, which adds a remaining-length check before reading TLV values in bgp_attr_encap. Debian issued a corresponding LTS package update documented in the Debian LTS Security Announcement. Red Hat Enterprise Linux 8 and 9 users should apply vendor-provided FRR errata as they become available.
Workarounds
- Apply BGP ingress filtering with route-map and bgp bestpath policies to reject unexpected attribute types from external peers.
- Deploy infrastructure ACLs limiting TCP 179 connectivity to known BGP peer addresses only.
- Configure bgpd under a process supervisor that automatically restarts the daemon and alerts on repeated crash loops.
# Example: restrict BGP peering to a specific neighbor address
router bgp 65001
neighbor 192.0.2.1 remote-as 65002
neighbor 192.0.2.1 password <shared-secret>
neighbor 192.0.2.1 timers 30 90
!
# Host-level ACL limiting BGP to trusted peers
iptables -A INPUT -p tcp --dport 179 -s 192.0.2.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 179 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
