*** This bug is a security vulnerability ***
Public security bug reported:
Summary
-------
The CVE-2024-55553 security updates ("bgpd: Validate only affected RPKI
prefixes instead of a full RIB") were derived from an unofficial upstream
backport for FRR 7.5 (FRRouting/frr commit 2fa79333, never merged into any
upstream branch). That backport removes the thread_add_read() call at the
top of bgpd_sync_callback() in bgpd/bgp_rpki.c and does not re-add it. The
upstream fix (b0800bfdf04b) and its stable/10.x backports keep the re-arm.
As a result, bgpd reads a single record from the internal RTR-to-bgpd socket
after start-up and never reads it again. Changes to the RPKI VRP set are no
longer applied to routes already received.
On focal (ESM Apps), the backport additionally calls functions that do not
exist in FRR 7.2.1 (bgp_table_subtree_lookup, bgp_dest_has_bgp_path_info_data).
The module builds with implicit-declaration warnings, and bgpd_rpki.so has
unresolved symbols, so "bgpd -M rpki" fails to load the module and exits.
Impact
------
noble, jammy: route origin validation fails to open after any VRP change. A
route that becomes RPKI Invalid stays installed and advertised despite an
inbound "match rpki invalid" deny, until "clear bgp ... soft in" or a bgpd
restart. Routes arriving after the change are still validated correctly.
focal (ESM Apps): bgpd configured with the rpki module (-M rpki) does not
start, so BGP is unavailable on those systems.
Affected versions
-----------------
noble: 8.4.4-1.1ubuntu6.3 up to and including 8.4.4-1.1ubuntu6.7
jammy: 8.1-1ubuntu1.12 up to and including 8.1-1ubuntu1.16
focal: 7.2.1-1ubuntu0.2+esm3 up to and including 7.2.1-1ubuntu0.2+esm4 (ESM
Apps)
Steps to reproduce (noble, jammy)
---------------------------------
1. Configure bgpd with -M rpki, an RPKI cache, an eBGP neighbor with
"soft-reconfiguration inbound" and an inbound route-map that denies
"match rpki invalid".
2. Once routes are received, change the cache's VRP set so that an
accepted route becomes Invalid.
3. "show rpki prefix-table" shows the new VRPs, but the route stays best
and advertised. "show thread cpu" shows bgpd_sync_callback invoked
once for the lifetime of the process.
4. "clear bgp <afi> <safi> <peer> soft in" corrects it.
Steps to reproduce (focal ESM Apps)
-----------------------------------
1. Install frr and frr-rpki-rtrlib 7.2.1-1ubuntu0.2+esm4.
2. Run: /usr/lib/frr/bgpd -M rpki -u frr -g frr -d
-> 'loading module "rpki" failed: ...', exit status 1.
Fix
---
noble, jammy: restore
thread_add_read(bm->master, bgpd_sync_callback, NULL,
rpki_sync_socket_bgpd, NULL);
as the first statement of bgpd_sync_callback().
focal: port the revalidation code to the FRR 7.2.1 bgp_node API, and
restore the same re-arm.
Related upstream
----------------
https://github.com/FRRouting/frr/issues/24001 reports a similar symptom on
FRR 10.x with different causes (proposed fix:
https://github.com/FRRouting/frr/pull/24131, not merged). One of those causes
is older than the CVE fix and exists in these releases too: a route the
inbound policy denied, and which has no other path, is not re-accepted when
it becomes Valid. Fixing this regression does not change that behaviour.
Reported by Andrew H. Bond.
** Affects: frr (Ubuntu)
Importance: Medium
Assignee: John Breton (john-breton)
Status: In Progress
** Affects: frr (Ubuntu Focal)
Importance: Medium
Assignee: John Breton (john-breton)
Status: In Progress
** Affects: frr (Ubuntu Jammy)
Importance: Medium
Assignee: John Breton (john-breton)
Status: In Progress
** Affects: frr (Ubuntu Noble)
Importance: Medium
Assignee: John Breton (john-breton)
Status: In Progress
** Also affects: frr (Ubuntu Focal)
Importance: Undecided
Status: New
** Also affects: frr (Ubuntu Noble)
Importance: Undecided
Status: New
** Also affects: frr (Ubuntu Jammy)
Importance: Undecided
Status: New
** Changed in: frr (Ubuntu Focal)
Assignee: (unassigned) => John Breton (john-breton)
** Changed in: frr (Ubuntu Jammy)
Assignee: (unassigned) => John Breton (john-breton)
** Changed in: frr (Ubuntu Noble)
Assignee: (unassigned) => John Breton (john-breton)
** Changed in: frr (Ubuntu)
Importance: Undecided => Medium
** Changed in: frr (Ubuntu)
Status: New => In Progress
** Changed in: frr (Ubuntu Noble)
Status: New => In Progress
** Changed in: frr (Ubuntu Jammy)
Status: New => In Progress
** Changed in: frr (Ubuntu Focal)
Importance: Undecided => Medium
** Changed in: frr (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: frr (Ubuntu Focal)
Status: New => In Progress
** Changed in: frr (Ubuntu Jammy)
Importance: Undecided => Medium
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172964
Title:
frr: CVE-2024-55553 backport stops RPKI revalidation after the first
VRP update (noble, jammy) and breaks the RPKI module (focal ESM)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/frr/+bug/2172964/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
