Executive brief
FRRouting FRR is a critical routing daemon software used to manage network routing on Linux and Unix systems. A local privilege escalation vulnerability allows an unprivileged service account to become root by exploiting a race condition in configuration file handling, potentially giving an attacker full control of the router and the ability to redirect network traffic.
Technical details
This is a time-of-check-time-of-use (TOCTOU) race condition in the configuration file initialization process. The vulnerable code uses touch() followed by chown() without proper synchronization, allowing the frr service user to monitor the /etc/frr directory and replace newly created configuration files with symlinks before ownership is set. By pointing symlinks to arbitrary files, an attacker can change file ownership to the frr user and ultimately gain root access. The attack requires local access as the frr service user and no authentication to the FRRouting service itself. This vulnerability was patched in FRRouting 8.5.
Affected products
- FRRouting Project FRR before 8.5
Timeline
- 2022: disclosed: CVE-2022-42917 published
- 2022: patched: Fixed in FRRouting FRR 8.5