CVE-2023-41360

An out-of-bounds read flaw was found in FRRouting in bgpd/bgp_packet.c, resulting from a boundary condition. This flaw allows a remote attacker, through specially crafted input, to read the initial byte of the ORF header in an ahead-of-stream scenario. This attacker can gain information and potentially launch further attacks against the affected system.

In Red Hat Enterprise Linux 8, the vulnerable code is not included. It was added in FRR-8.4 in upstream. The highest version of FRR utilized in RHEL-8 is 7.5. Hence, versions of FRR shipped with RHEL-8 are not affected by this vulnerability.

Red Hat Product Security rated this vulnerability as a LOW security impact because it only exposes the initial byte of the ORF header in an ahead-of-stream situation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.