Ubuntu releases FRRouting update to fix RPKI regression and security vulnerabilities

Ubuntu has issued security notice USN-7230-3 to address a regression in the FRRouting (FRR) suite of internet protocols. The regression was introduced in a previous update (USN-7230-2) intended to fix CVE-2024-55553, which caused the software to stop processing RPKI updates after the initial one, preventing route revalidation.

This update affects multiple Ubuntu Long Term Support (LTS) releases, including 24.04, 22.04, and 20.04. Specifically, users on Ubuntu 20.04 LTS experienced a critical failure where the BGP daemon would fail to start entirely if the RPKI module was enabled. The new package versions restore proper RPKI functionality and maintain the security fixes for previous vulnerabilities.

Technical details of the FRR regression and vulnerabilities

• RPKI Functionality: The regression caused FRR to cease processing RPKI updates after the first instance, which prevented the system from revalidating routes when RPKI data changed.
• BGP Daemon Failure: On Ubuntu 20.04 LTS, the RPKI module activation caused a fatal error that prevented the BGP daemon from initializing.
• CVE-2024-44070: A vulnerability where incorrect handling of certain BGP messages could allow a remote attacker to cause a denial of service by crashing FRR, specifically affecting Ubuntu 20.04 LTS.
• CVE-2024-55553: A performance-related vulnerability where an internal socket buffer overflow could trigger unnecessary re-validation of all routes, potentially leading to a denial of service.

Why it matters

This update is critical for network administrators using FRR for BGP routing and RPKI-based route validation. Failure to apply this fix could lead to stale routing information or complete BGP service outages on older Ubuntu LTS systems.