CVE-2022-42917 FRRouting CVE debrief

Who should care

Defenders responsible for FRRouting FRR installations should assess exposure and prioritize verification and remediation. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

Defenders should prioritize verifying and upgrading to FRR version 8.5 or later, and monitoring configuration directory changes to prevent privilege escalation.

• Privilege escalation to root is possible for the service user
• Configuration file integrity is compromised
• Additional security controls are required to prevent exploitation

Technical summary

The vulnerability exists in FRRouting FRR before 8.5, where the service user can escalate privileges to root by monitoring the configuration directory and replacing config files with symlinks. This is a TOCTOU Race Condition caused by a combination of touch and chown. The service user can monitor the configuration directory (/etc/frr) and replace config files upon creation with symlinks to change the ownership of arbitrary files. Defenders should prioritize verifying and upgrading to FRR version 8.5 or later, and monitoring configuration directory changes.

Defensive priority

Defenders should prioritize verifying and upgrading to FRR version 8.5 or later, and monitoring configuration directory changes.

Recommended defensive actions

• Verify and upgrade to FRR version 8.5 or later
• Monitor configuration directory changes
• Implement additional security controls to prevent privilege escalation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a combination of touch and chown, allowing the service user to escalate privileges to root. The service user can monitor the configuration directory (/etc/frr) and replace config files upon creation with symlinks to change the ownership of arbitrary files. Defenders should verify the configuration directory and ensure that the service user does not have write access to it.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.