CVE-2025-61106: FRRouting OSPF NULL Pointer DoS Flaw

CVE-2025-61106 Overview

A NULL pointer dereference vulnerability has been discovered in FRRouting (FRR), the popular open-source network routing protocol suite. The vulnerability exists in the show_vty_ext_pref_pref_sid function within the ospf_ext.c file, affecting FRRouting versions 4.0 through 10.4.1. This flaw allows remote attackers to cause a Denial of Service (DoS) condition by sending specially crafted OSPF (Open Shortest Path First) packets to vulnerable systems.

Critical Impact

Network attackers can remotely crash FRRouting daemon services by exploiting this NULL pointer dereference, disrupting routing operations across enterprise and service provider networks without requiring authentication.

Affected Products

• FRRouting (FRR) versions 4.0 through 10.4.1
• Network devices and Linux systems running vulnerable FRRouting installations
• Infrastructure deployments utilizing OSPF routing with affected FRR versions

Discovery Timeline

• 2025-10-28 - CVE-2025-61106 published to NVD
• 2025-10-31 - Last updated in NVD database

Technical Details for CVE-2025-61106

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference), a memory corruption issue that occurs when an application attempts to dereference a pointer that is expected to be valid but is instead NULL. In the context of FRRouting, the vulnerability manifests within OSPF protocol handling code, specifically in the show_vty_ext_pref_pref_sid function located in ospf_ext.c.

When processing OSPF packets, the affected function fails to properly validate pointer references before use. An attacker can exploit this by crafting malicious OSPF packets that trigger the NULL dereference condition, causing the FRRouting daemon to crash. Since this affects routing infrastructure, successful exploitation can disrupt network connectivity and routing convergence across affected network segments.

The vulnerability is exploitable over the network without requiring authentication or user interaction, making it particularly dangerous for exposed routing infrastructure. However, the impact is limited to availability—there is no data confidentiality or integrity breach associated with this vulnerability.

Root Cause

The root cause of this vulnerability lies in insufficient pointer validation within the show_vty_ext_pref_pref_sid function in ospf_ext.c. The function processes OSPF extension prefix segment identifier (SID) data without verifying that required data structures are properly initialized. When a crafted OSPF packet arrives containing specific malformed data or missing expected fields, the code attempts to access memory through a NULL pointer, resulting in a segmentation fault and daemon crash.

This type of programming error is common in C-based network protocol implementations where complex data structures are passed between functions without consistent validation checks at each access point.

Attack Vector

The attack vector for CVE-2025-61106 is network-based, requiring no prior authentication or special privileges. An attacker can exploit this vulnerability by:

1. Sending specially crafted OSPF packets to a target system running vulnerable FRRouting versions
2. The malicious packets trigger the code path in show_vty_ext_pref_pref_sid that contains the NULL pointer dereference
3. Upon processing the crafted packet, the FRR daemon crashes, disrupting routing services

The vulnerability can be exploited remotely by any attacker who can send OSPF packets to the vulnerable system. In typical network deployments, OSPF operates within specific network segments, potentially limiting exposure. However, misconfigured or internet-exposed routing infrastructure would be at higher risk.

The attack does not require complex exploitation techniques—a single crafted packet can trigger the crash condition. For technical details regarding the vulnerability trigger, see the GitHub CVE-2025-61106 Details and the related GitHub Issue #19471.

Detection Methods for CVE-2025-61106

Indicators of Compromise

• Unexpected FRRouting daemon crashes or service restarts without administrative action
• Core dumps from the FRR OSPF daemon (ospfd) with stack traces pointing to show_vty_ext_pref_pref_sid in ospf_ext.c
• System logs showing segmentation faults or NULL pointer dereference errors from FRR processes
• Network monitoring alerts for unusual OSPF packet patterns or malformed OSPF traffic

Detection Strategies

• Deploy network intrusion detection systems (IDS) with signatures for malformed OSPF packets targeting known vulnerabilities
• Monitor FRRouting process stability and implement alerting for unexpected daemon terminations
• Analyze OSPF traffic for anomalous packet structures that deviate from RFC specifications
• Review system logs for segmentation fault events associated with FRR processes

Monitoring Recommendations

• Implement process monitoring for FRRouting daemons with automatic restart capabilities and alerting
• Configure syslog collection and analysis for crash events related to ospfd service
• Establish baseline network behavior for OSPF traffic to detect anomalies indicative of exploitation attempts
• Deploy endpoint detection and response (EDR) solutions capable of detecting crash-based DoS attacks

How to Mitigate CVE-2025-61106

Immediate Actions Required

• Upgrade FRRouting to a patched version that addresses CVE-2025-61106 (versions after 10.4.1)
• Review network exposure of OSPF-enabled interfaces and restrict OSPF adjacencies to trusted peers only
• Implement network segmentation to limit potential attack surfaces for routing infrastructure
• Enable process monitoring and automatic restart for FRRouting services to minimize downtime during potential attacks

Patch Information

The FRRouting project has addressed this vulnerability through GitHub Pull Request #19480. The specific fix can be found in commit fdd9574, which adds proper NULL pointer validation before dereferencing in the affected function.

Organizations should apply this patch by upgrading to the latest FRRouting release that includes this fix. The patch adds defensive checks to ensure that pointer references are valid before accessing the data structures in show_vty_ext_pref_pref_sid.

Workarounds

• Restrict OSPF communications to trusted network segments using firewall rules and access control lists
• Implement OSPF authentication (MD5 or cryptographic authentication) to limit acceptance of OSPF packets from unauthorized sources
• Deploy network-based filtering to block potentially malformed OSPF packets before they reach routing infrastructure
• Consider temporarily disabling unused OSPF features or interfaces until patches can be applied

# Example: Configure OSPF authentication to limit attack surface
# Add to FRRouting configuration (vtysh)
router ospf
 area 0 authentication message-digest
!
interface eth0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 YourSecretKey