Executive Summary

Title Multiple BGP implementations are vulnerable to improperly formatted BGP updates
Name VU#347067 First vendor Publication 2023-09-12
Vendor VU-CERT Last vendor Modification 2023-11-16
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Overall CVSS Score 7.5
Base Score 7.5 Environmental Score 7.5
impact SubScore 3.6 Temporal Score 7.5
Exploitabality Sub Score 3.9
Attack Vector Network Attack Complexity Low
Privileges Required None User Interaction None
Scope Unchanged Confidentiality Impact None
Integrity Impact None Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score N/A Attack Range N/A
Cvss Impact Score N/A Attack Complexity N/A
Cvss Expoit Score N/A Authentication N/A
Calculate full CVSS 2.0 Vectors scores



Multiple BGP implementations have been identified as vulnerable to specially crafted Path Attributes of a BGP UPDATE. Instead of ignoring invalid updates they reset the underlying TCP connection for the BGP session and de-peer the router.

This is undesirable because a session reset impacts not only routes with the BGP UPDATE but also the other valid routes exchanged over the session. RFC 7606 Introduction


The Border Gateway Protocol (BGP, RFC 4271) is a widely used inter-Autonomous System routing protocol. BGP communication among peer routers is critical to the stable operation of the Internet. A number of known BGP security issues were addressed in RFC 7606Revised Error Handling for BGP UPDATE Messages in 2015.

Recent reports indicate that multiple BGP implementations do not properly handle specially crafted Path Attributes in the BGP UPDATE messages. An attacker with a valid, configured BGP session could inject a specially crafted packet into an existing BGP session or the underlying TCP session (179/tcp). A vulnerable BGP implementation could drop sessions when processing crafted UPDATE messages. A persistent attack could lead to routing instability (route flapping).

This vulnerability was first announced as affecting OpenBSD based routers. Further investigation indicates that other vendors are affected by the same or similar issues. Please see the Systems Affected section below. Here are the CVE IDs that were reserved by the reporter for different vendors that were tested:

  • CVE-2023-4481 (Juniper)
  • CVE-2023-38802 (FRR)
  • CVE-2023-38283 (OpenBGPd)
  • CVE-2023-40457 (EXOS)


A remote attacker could publish a BGP UPDATE with a crafted set of Path Attributes, causing vulnerable routers to de-peer from any link from which such an update were received. Unaffected routers might also pass the crafted updates across the network, potentially leading to the update arriving at an affected router from multiple sources, causing multiple links to fail.


The CERT/CC is currently unaware of a practical solutions for every vendor but some of the vendors allow you to change the response to errors in BGP path updates. Networks using appliances from Juniper and Nokia can mitigate this behavior by enabling:

set protocols bgp bgp-error-tolerance

[router bgp group]
error-handling update-fault-tolerance


Thanks to the reporter Ben Cartwright-Cox. This document was written by Timur Snoke.

Original Source

Url : https://kb.cert.org/vuls/id/347067

CWE : Common Weakness Enumeration

% Id Name
33 % CWE-754 Improper Check for Unusual or Exceptional Conditions
33 % CWE-354 Improper Validation of Integrity Check Value
33 % CWE-20 Improper Input Validation

CPE : Common Platform Enumeration

Application 14
Application 1
Application 1
Application 2
Hardware 1
Os 3
Os 3
Os 1071
Os 145
Os 44
Os 1

Alert History

If you want to see full details history, please login or register.
Date Informations
2023-11-16 17:22:12
  • Multiple Updates
2023-09-15 17:22:10
  • Multiple Updates
2023-09-12 21:22:09
  • First insertion