VU#347067: Multiple BGP implementations are vulnerable to improperly formatted BGP updates

Overview

Multiple BGP implementations have been identified as vulnerable to specially crafted Path Attributes of a BGP UPDATE. Instead of ignoring invalid updates they reset the underlying TCP connection for the BGP session and de-peer the router.

This is undesirable because a session reset impacts not only routes with the BGP UPDATE but also the other valid routes exchanged over the session. RFC 7606 Introduction

Description

The Border Gateway Protocol (BGP, RFC 4271) is a widely used inter-Autonomous System routing protocol. BGP communication among peer routers is critical to the stable operation of the Internet. A number of known BGP security issues were addressed in RFC 7606 Revised Error Handling for BGP UPDATE Messages in 2015.

Recent reports indicate that multiple BGP implementations do not properly handle specially crafted Path Attributes in the BGP UPDATE messages. An attacker with a valid, configured BGP session could inject a specially crafted packet into an existing BGP session or the underlying TCP session (179/tcp). A vulnerable BGP implementation could drop sessions when processing crafted UPDATE messages. A persistent attack could lead to routing instability (route flapping).

This vulnerability was first announced as affecting OpenBSD based routers. Further investigation indicates that other vendors are affected by the same or similar issues. Please see the Systems Affected section below.
Here are the CVE IDs that were reserved by the reporter for different vendors that were tested:

CVE-2023-4481 (Juniper)
CVE-2023-38802 (FRR)
CVE-2023-38283 (OpenBGPd)
CVE-2023-40457 (EXOS)

Impact

A remote attacker could publish a BGP UPDATE with a crafted set of Path Attributes, causing vulnerable routers to de-peer from any link from which such an update were received. Unaffected routers might also pass the crafted updates across the network, potentially leading to the update arriving at an affected router from multiple sources, causing multiple links to fail.

Solution

The CERT/CC is currently unaware of a practical solutions for every vendor but some of the vendors allow you to change the response to errors in BGP path updates. Networks using appliances from Juniper and Nokia can mitigate this behavior by enabling:

(Juniper)
set protocols bgp bgp-error-tolerance

(Nokia)
[router bgp group]
error-handling update-fault-tolerance

Acknowledgements

Thanks to the reporter Ben Cartwright-Cox. This document was written by Timur Snoke.

Vendor Information

References

http://tools.ietf.org/html/rfc4271

https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/006_bgpd.patch.sig

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38802

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38283

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40457

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4481

http://tools.ietf.org/html/rfc7606

https://github.com/FRRouting/frr/pull/14290

https://kb.juniper.net/JSA72510

https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling