CVE-2025-43973: Osrg GoBGP Input Validation Vulnerability

CVE-2025-43973 Overview

An input validation vulnerability was discovered in GoBGP before version 3.35.0. The vulnerability exists in pkg/packet/rtr/rtr.go, where the RTR (RPKI-to-Router) message parser fails to verify that the input length corresponds to a situation in which all bytes are available for an RTR message. This off-by-one error (CWE-193) can be exploited remotely without authentication, potentially leading to memory corruption or denial of service conditions.

Critical Impact

Remote attackers can exploit insufficient input length validation in the RTR message parser to potentially cause memory corruption, unauthorized data access, or complete system compromise without requiring authentication.

Affected Products

• GoBGP versions prior to 3.35.0
• osrg gobgp (all versions before the security patch)

Discovery Timeline

• 2025-04-21 - CVE-2025-43973 published to NVD
• 2025-05-08 - Last updated in NVD database

Technical Details for CVE-2025-43973

Vulnerability Analysis

This vulnerability stems from an off-by-one error (CWE-193) in the RTR message parsing functionality of GoBGP. The RTR protocol is used to deliver RPKI (Resource Public Key Infrastructure) data from RPKI cache servers to BGP routers, making this a critical component in network routing security infrastructure.

The vulnerable code in pkg/packet/rtr/rtr.go processes incoming RTR messages without first validating that sufficient bytes are available in the input buffer. When the parser attempts to access data[1] to determine the message type via a switch statement, it does so without confirming that at least one byte exists in the input data. This boundary condition error can be triggered remotely over the network.

The vulnerability allows an unauthenticated network attacker to send malformed RTR messages with insufficient data, potentially triggering out-of-bounds memory access, crashes, or exploitable conditions that could lead to arbitrary code execution.

Root Cause

The root cause is a missing bounds check in the ParseRTR function within pkg/packet/rtr/rtr.go. The function immediately attempts to access array indices without first validating that the input slice contains sufficient data. This is a classic off-by-one error where the code assumes data availability without explicit verification, leading to potential out-of-bounds access when processing malformed or truncated RTR messages.

Attack Vector

The attack can be executed remotely over the network. An attacker can send specially crafted RTR messages with truncated or empty payloads to a GoBGP instance that processes RTR protocol data. Since no authentication or user interaction is required, the attack surface is significant for any GoBGP deployment processing RTR messages from untrusted or compromised RPKI cache servers.

// Security patch from pkg/packet/rtr/rtr.go
// Source: https://github.com/osrg/gobgp/commit/5693c58a4815cc6327b8d3b6980f0e5aced28abe

 }
 
 func ParseRTR(data []byte) (RTRMessage, error) {
+	if len(data) < 1 {
+		return nil, fmt.Errorf("not all bytes are available for RTR message")
+	}
 	var msg RTRMessage
 	switch data[1] {
 	case RTR_SERIAL_NOTIFY:

The patch adds a critical length validation check before attempting to access the message type byte, ensuring the parser fails safely when presented with insufficient data.

Detection Methods for CVE-2025-43973

Indicators of Compromise

• Unexpected crashes or restarts of GoBGP daemon processes
• Unusual RTR protocol traffic patterns or malformed RTR messages in network captures
• Log entries indicating RTR parsing errors or panics in pkg/packet/rtr/rtr.go
• Memory corruption indicators or abnormal memory usage in GoBGP processes
• Suspicious connections from unknown sources to RTR protocol ports (typically TCP 8282)

Detection Strategies

• Monitor GoBGP process stability and look for unexpected crashes or restarts
• Implement network traffic analysis to detect malformed or truncated RTR messages
• Deploy application-level logging to capture RTR parsing failures and errors
• Use runtime application self-protection (RASP) to detect out-of-bounds memory access attempts

Monitoring Recommendations

• Enable verbose logging for RTR protocol message processing in GoBGP
• Monitor system resources for GoBGP processes including memory usage and CPU spikes
• Implement alerting on RTR connection anomalies from RPKI cache servers
• Regularly review GoBGP logs for parsing errors or unexpected exceptions

How to Mitigate CVE-2025-43973

Immediate Actions Required

• Upgrade GoBGP to version 3.35.0 or later immediately
• Review RTR protocol connections and restrict access to trusted RPKI cache servers only
• Implement network segmentation to limit exposure of GoBGP RTR interfaces
• Monitor GoBGP instances for signs of exploitation attempts while planning upgrades

Patch Information

The vulnerability has been addressed in GoBGP version 3.35.0. The security fix was committed to the repository with commit hash 5693c58a4815cc6327b8d3b6980f0e5aced28abe. Organizations should upgrade from any version prior to 3.35.0 to receive the security patch.

For detailed information about the patch, refer to the GitHub Commit Details or review the Version Comparison between v3.34.0 and v3.35.0.

Workarounds

• Restrict RTR protocol access using firewall rules to only allow connections from trusted RPKI cache servers
• Implement network access controls to limit which sources can send RTR messages to GoBGP instances
• Deploy an intrusion prevention system (IPS) with rules to detect and block malformed RTR messages
• Consider temporarily disabling RTR functionality if not immediately required until patching is complete

# Example: Restrict RTR port access to trusted RPKI cache servers only
iptables -A INPUT -p tcp --dport 8282 -s trusted_rpki_cache_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 8282 -j DROP