CVE-2023-3748

Published Jul 24, 2023

Last updated a year ago

Overview

Description: A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages with the unicast flag set, the interval field set to 0, or any TLV that contains a sub-TLV with the Mandatory flag set to enter an infinite loop and cause a denial of service.
Source: secalert@redhat.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-835
secalert@redhat.com: CWE-835

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AB0E7F12-AAE7-48DA-B684-585BA3188B28",
            "versionEndExcluding": "8.5"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References