CVE-2022-37035

frr: use-after-free bug due to race conditions in two threads

Loading…

Severity

Moderate

Red Hat Product Security

8.1

CVSS 3.1

Review impact separately from score.

Published · August 3, 2022

Updated · November 21, 2025

Description

A flaw was found in bgpd in FRRouting (FRR). There is a possible use-after-free issue due to a race condition in bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c. This issue can lead to remote code execution or information disclosure by sending crafted BGP packets.

Statement

User interaction is not needed for exploitation.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')