FRRouting FRR EVPN Type-2 Route bgp_evpn.c process_type2_route access control
A pull request for this has already been merged.
- #543103 by @r-ryantm — merged
- Dominant language
- Nix
- Stars
- 26.2k
- Forks
- 20.1k
- PR merge metrics
- PR metrics pending
Description
- CVE-2026-5107
- Nixpkgs security tracker issue
- affected package maintainers: cc @thillux, @woffs
Description
A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.
4.2 MEDIUM | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C
- CVSS version: 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): Low (L)
- Availability (A): Low (L)
- Exploit Code Maturity (E): Not Defined (X)
- Remediation Level (RL): Official Fix (O)
- Report Confidence (RC): Confirmed (C)
Affected packages
frr(10.4.1@nixos-25.11, 10.5.3@nixos-unstable)
Additional comment
https://github.com/FRRouting/frr/commit/7676cad65114aa23adde583d91d9d29e2debd045
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the upstream FRRouting commit 7676cad65114aa23adde583d91d9d29e2debd045 and the nixpkgs frr package definition. Confirm that the package incorporates the fix for bgpd/bgp_evpn.c and that the affected versions are no longer exposed; the linked merged pull request indicates this work is already complete.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 25/100