Skip to content

Commit 23c2ed4

Browse files
CBL-Mariner-BotKanishk-BansalKanishk Bansal
authored
[AUTO-CHERRYPICK] Patch frr for CVE-2024-55553 [High] - branch 3.0-dev (#14062)
Co-authored-by: Kanishk Bansal <[email protected]> Co-authored-by: Kanishk Bansal <[email protected]>
1 parent 435a54c commit 23c2ed4

File tree

2 files changed

+263
-1
lines changed

2 files changed

+263
-1
lines changed

‎SPECS/frr/CVE-2024-55553.patch

Lines changed: 258 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,258 @@
1+
From ee33d7a891c9e7abb5020e849f51a9ea8a91b850 Mon Sep 17 00:00:00 2001
2+
From: Kanishk Bansal <[email protected]>
3+
Date: Thu, 19 Jun 2025 06:40:11 +0000
4+
Subject: [PATCH] Backport CVE-2024-55553
5+
6+
Upstream Reference : https://github.com/FRRouting/frr/commit/b0800bfdf04b4fcf48504737ebfe4ba7f05268d3
7+
8+
Signed-off-by: Kanishk Bansal <[email protected]>
9+
---
10+
bgpd/bgp_rpki.c | 139 ++++++++++++++++++++++--------------------------
11+
bgpd/bgpd.c | 4 --
12+
bgpd/bgpd.h | 1 -
13+
3 files changed, 65 insertions(+), 79 deletions(-)
14+
15+
diff --git a/bgpd/bgp_rpki.c b/bgpd/bgp_rpki.c
16+
index f0b2ffd..8ccb948 100644
17+
--- a/bgpd/bgp_rpki.c
18+
+++ b/bgpd/bgp_rpki.c
19+
@@ -48,6 +48,7 @@ DEFINE_MTYPE_STATIC(BGPD, BGP_RPKI_CACHE_GROUP, "BGP RPKI Cache server group");
20+
DEFINE_MTYPE_STATIC(BGPD, BGP_RPKI_RTRLIB, "BGP RPKI RTRLib");
21+
DEFINE_MTYPE_STATIC(BGPD, BGP_RPKI_REVALIDATE, "BGP RPKI Revalidation");
22+
23+
+
24+
#define POLLING_PERIOD_DEFAULT 3600
25+
#define EXPIRE_INTERVAL_DEFAULT 7200
26+
#define RETRY_INTERVAL_DEFAULT 600
27+
@@ -108,7 +109,6 @@ static void print_record(const struct pfx_record *record, struct vty *vty,
28+
json_object *json, enum asnotation_mode asnotation);
29+
static bool is_synchronized(void);
30+
static bool is_running(void);
31+
-static bool is_stopping(void);
32+
static void route_match_free(void *rule);
33+
static enum route_map_cmd_result_t route_match(void *rule,
34+
const struct prefix *prefix,
35+
@@ -116,7 +116,6 @@ static enum route_map_cmd_result_t route_match(void *rule,
36+
void *object);
37+
static void *route_match_compile(const char *arg);
38+
static void revalidate_bgp_node(struct bgp_dest *dest, afi_t afi, safi_t safi);
39+
-static void revalidate_all_routes(void);
40+
41+
static struct rtr_mgr_config *rtr_config;
42+
static struct list *cache_list;
43+
@@ -354,11 +353,6 @@ inline bool is_running(void)
44+
return rtr_is_running;
45+
}
46+
47+
-inline bool is_stopping(void)
48+
-{
49+
- return rtr_is_stopping;
50+
-}
51+
-
52+
static void pfx_record_to_prefix(struct pfx_record *record,
53+
struct prefix *prefix)
54+
{
55+
@@ -402,40 +396,19 @@ static void rpki_revalidate_prefix(struct event *thread)
56+
XFREE(MTYPE_BGP_RPKI_REVALIDATE, rrp);
57+
}
58+
59+
-static void bgpd_sync_callback(struct event *thread)
60+
+static void revalidate_single_prefix(struct vrf *vrf, struct prefix prefix, afi_t afi)
61+
{
62+
struct bgp *bgp;
63+
struct listnode *node;
64+
- struct prefix prefix;
65+
- struct pfx_record rec;
66+
-
67+
- event_add_read(bm->master, bgpd_sync_callback, NULL,
68+
- rpki_sync_socket_bgpd, NULL);
69+
-
70+
- if (atomic_load_explicit(&rtr_update_overflow, memory_order_seq_cst)) {
71+
- while (read(rpki_sync_socket_bgpd, &rec,
72+
- sizeof(struct pfx_record)) != -1)
73+
- ;
74+
-
75+
- atomic_store_explicit(&rtr_update_overflow, 0,
76+
- memory_order_seq_cst);
77+
- revalidate_all_routes();
78+
- return;
79+
- }
80+
-
81+
- int retval =
82+
- read(rpki_sync_socket_bgpd, &rec, sizeof(struct pfx_record));
83+
- if (retval != sizeof(struct pfx_record)) {
84+
- RPKI_DEBUG("Could not read from rpki_sync_socket_bgpd");
85+
- return;
86+
- }
87+
- pfx_record_to_prefix(&rec, &prefix);
88+
-
89+
- afi_t afi = (rec.prefix.ver == LRTR_IPV4) ? AFI_IP : AFI_IP6;
90+
91+
for (ALL_LIST_ELEMENTS_RO(bm->bgp, node, bgp)) {
92+
safi_t safi;
93+
94+
+ if (!vrf && bgp->vrf_id != VRF_DEFAULT)
95+
+ continue;
96+
+ if (vrf && bgp->vrf_id != vrf->vrf_id)
97+
+ continue;
98+
+
99+
for (safi = SAFI_UNICAST; safi < SAFI_MAX; safi++) {
100+
struct bgp_table *table = bgp->rib[afi][safi];
101+
struct rpki_revalidate_prefix *rrp;
102+
@@ -448,12 +421,67 @@ static void bgpd_sync_callback(struct event *thread)
103+
rrp->prefix = prefix;
104+
rrp->afi = afi;
105+
rrp->safi = safi;
106+
- event_add_event(bm->master, rpki_revalidate_prefix, rrp,
107+
- 0, &bgp->t_revalidate[afi][safi]);
108+
+ event_add_event(bm->master, rpki_revalidate_prefix, rrp, 0, &bgp->t_revalidate[afi][safi]);
109+
}
110+
}
111+
}
112+
113+
+
114+
+static void bgpd_sync_callback(struct event *thread)
115+
+{
116+
+ struct prefix prefix;
117+
+ struct pfx_record rec;
118+
+ struct rpki_vrf *rpki_vrf = EVENT_ARG(thread);
119+
+ struct vrf *vrf = NULL;
120+
+ afi_t afi;
121+
+ int retval;
122+
+
123+
+ event_add_read(bm->master, bgpd_sync_callback, rpki_vrf, rpki_vrf->rpki_sync_socket_bgpd,
124+
+ NULL);
125+
+
126+
+ if (rpki_vrf->vrfname) {
127+
+ vrf = vrf_lookup_by_name(rpki_vrf->vrfname);
128+
+ if (!vrf) {
129+
+ zlog_err("%s(): vrf for rpki %s not found", __func__, rpki_vrf->vrfname);
130+
+ return;
131+
+ }
132+
+ }
133+
+
134+
+ if (atomic_load_explicit(&rpki_vrf->rtr_update_overflow, memory_order_seq_cst)) {
135+
+ ssize_t size = 0;
136+
+
137+
+ retval = read(rpki_vrf->rpki_sync_socket_bgpd, &rec, sizeof(struct pfx_record));
138+
+ while (retval != -1) {
139+
+ if (retval != sizeof(struct pfx_record))
140+
+ break;
141+
+
142+
+ size += retval;
143+
+ pfx_record_to_prefix(&rec, &prefix);
144+
+ afi = (rec.prefix.ver == LRTR_IPV4) ? AFI_IP : AFI_IP6;
145+
+ revalidate_single_prefix(vrf, prefix, afi);
146+
+
147+
+ retval = read(rpki_vrf->rpki_sync_socket_bgpd, &rec,
148+
+ sizeof(struct pfx_record));
149+
+ }
150+
+
151+
+ RPKI_DEBUG("Socket overflow detected (%zu), revalidating affected prefixes", size);
152+
+
153+
+ atomic_store_explicit(&rpki_vrf->rtr_update_overflow, 0, memory_order_seq_cst);
154+
+ return;
155+
+ }
156+
+
157+
+ retval = read(rpki_vrf->rpki_sync_socket_bgpd, &rec, sizeof(struct pfx_record));
158+
+ if (retval != sizeof(struct pfx_record)) {
159+
+ RPKI_DEBUG("Could not read from rpki_sync_socket_bgpd");
160+
+ return;
161+
+ }
162+
+ pfx_record_to_prefix(&rec, &prefix);
163+
+
164+
+ afi = (rec.prefix.ver == LRTR_IPV4) ? AFI_IP : AFI_IP6;
165+
+
166+
+ revalidate_single_prefix(vrf, prefix, afi);
167+
+}
168+
+
169+
static void revalidate_bgp_node(struct bgp_dest *bgp_dest, afi_t afi,
170+
safi_t safi)
171+
{
172+
@@ -501,48 +529,11 @@ static void bgp_rpki_revalidate_peer(struct event *thread)
173+
XFREE(MTYPE_BGP_RPKI_REVALIDATE, rvp);
174+
}
175+
176+
-static void revalidate_all_routes(void)
177+
-{
178+
- struct bgp *bgp;
179+
- struct listnode *node;
180+
-
181+
- for (ALL_LIST_ELEMENTS_RO(bm->bgp, node, bgp)) {
182+
- struct peer *peer;
183+
- struct listnode *peer_listnode;
184+
-
185+
- for (ALL_LIST_ELEMENTS_RO(bgp->peer, peer_listnode, peer)) {
186+
- afi_t afi;
187+
- safi_t safi;
188+
-
189+
- FOREACH_AFI_SAFI (afi, safi) {
190+
- struct rpki_revalidate_peer *rvp;
191+
-
192+
- if (!bgp->rib[afi][safi])
193+
- continue;
194+
-
195+
- if (!peer_established(peer->connection))
196+
- continue;
197+
-
198+
- rvp = XCALLOC(MTYPE_BGP_RPKI_REVALIDATE,
199+
- sizeof(*rvp));
200+
- rvp->peer = peer;
201+
- rvp->afi = afi;
202+
- rvp->safi = safi;
203+
-
204+
- event_add_event(
205+
- bm->master, bgp_rpki_revalidate_peer,
206+
- rvp, 0,
207+
- &peer->t_revalidate_all[afi][safi]);
208+
- }
209+
- }
210+
- }
211+
-}
212+
-
213+
static void rpki_update_cb_sync_rtr(struct pfx_table *p __attribute__((unused)),
214+
const struct pfx_record rec,
215+
const bool added __attribute__((unused)))
216+
{
217+
- if (is_stopping() ||
218+
+ if (rtr_is_stopping ||
219+
atomic_load_explicit(&rtr_update_overflow, memory_order_seq_cst))
220+
return;
221+
222+
diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c
223+
index edb20ac..cfa1930 100644
224+
--- a/bgpd/bgpd.c
225+
+++ b/bgpd/bgpd.c
226+
@@ -1248,8 +1248,6 @@ static void peer_free(struct peer *peer)
227+
bgp_reads_off(peer->connection);
228+
bgp_writes_off(peer->connection);
229+
event_cancel_event_ready(bm->master, peer->connection);
230+
- FOREACH_AFI_SAFI (afi, safi)
231+
- EVENT_OFF(peer->t_revalidate_all[afi][safi]);
232+
assert(!peer->connection->t_write);
233+
assert(!peer->connection->t_read);
234+
event_cancel_event_ready(bm->master, peer->connection);
235+
@@ -2637,8 +2635,6 @@ int peer_delete(struct peer *peer)
236+
bgp_reads_off(peer->connection);
237+
bgp_writes_off(peer->connection);
238+
event_cancel_event_ready(bm->master, peer->connection);
239+
- FOREACH_AFI_SAFI (afi, safi)
240+
- EVENT_OFF(peer->t_revalidate_all[afi][safi]);
241+
assert(!CHECK_FLAG(peer->connection->thread_flags,
242+
PEER_THREAD_WRITES_ON));
243+
assert(!CHECK_FLAG(peer->connection->thread_flags,
244+
diff --git a/bgpd/bgpd.h b/bgpd/bgpd.h
245+
index dda108b..70c728c 100644
246+
--- a/bgpd/bgpd.h
247+
+++ b/bgpd/bgpd.h
248+
@@ -1568,7 +1568,6 @@ struct peer {
249+
250+
/* Threads. */
251+
struct event *t_llgr_stale[AFI_MAX][SAFI_MAX];
252+
- struct event *t_revalidate_all[AFI_MAX][SAFI_MAX];
253+
struct event *t_refresh_stalepath;
254+
255+
/* Thread flags. */
256+
--
257+
2.45.3
258+

‎SPECS/frr/frr.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Summary: Routing daemon
44
Name: frr
55
Version: 9.1.1
6-
Release: 2%{?dist}
6+
Release: 3%{?dist}
77
License: GPL-2.0-or-later
88
Vendor: Microsoft Corporation
99
Distribution: Azure Linux
@@ -17,6 +17,7 @@ Patch2: 0002-disable-eigrp-crypto.patch
1717
Patch3: 0003-fips-mode.patch
1818
Patch4: 0004-remove-grpc-test.patch
1919
Patch5: CVE-2024-44070.patch
20+
Patch6: CVE-2024-55553.patch
2021

2122
BuildRequires: autoconf
2223
BuildRequires: automake
@@ -199,6 +200,9 @@ rm tests/lib/*grpc*
199200
%{_sysusersdir}/%{name}.conf
200201

201202
%changelog
203+
* Tue Jun 17 2025 Kanishk Bansal <[email protected]> - 9.1.1-3
204+
- Backport Patch CVE-2024-55553
205+
202206
* Wed Aug 21 2024 Brian Fjeldstad <[email protected]> - 9.1.1-2
203207
- Fix CVE-2024-44070
204208

0 commit comments

Comments
 (0)