bgpd: Prevent from one more CVE triggering this place

If we receive an attribute that is handled by bgp_attr_malformed(), use treat-as-withdraw behavior for unknown (or missing to add - if new) attributes. Signed-off-by: Donatas Abraitis <[email protected]>
FRRouting · Mar 28, 2024 · b33d0b9 · b33d0b9
1 parent ba6a8f1
commit b33d0b9
Showing 1 changed file with 12 additions and 2 deletions.
diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
@@ -1365,6 +1365,7 @@ bgp_attr_malformed(struct bgp_attr_parser_args *args, uint8_t subcode,
 	 * the caller therefore signals this with the seperate length argument
 	 */
 	uint8_t *notify_datap = (length > 0 ? args->startp : NULL);
+	bool unhandled_attr = false;
 
 	if (bgp_debug_update(peer, NULL, NULL, 1)) {
 		char attr_str[BUFSIZ] = {0};
@@ -1426,6 +1427,15 @@ bgp_attr_malformed(struct bgp_attr_parser_args *args, uint8_t subcode,
 					  BGP_NOTIFY_UPDATE_ERR, subcode,
 					  notify_datap, length);
 		return BGP_ATTR_PARSE_ERROR;
+	default:
+		/* Unknown attributes, that are handled by this function
+		 * should be treated as withdraw, to prevent one more CVE
+		 * from being introduced.
+		 */
+		flog_err(EC_BGP_ATTR_FLAG,
+			 "%s attribute received, while it is not known how to handle it, treating as withdraw",
+			 lookup_msg(attr_str, args->type, NULL));
+		unhandled_attr = true;
 	}
 
 	/* Partial optional attributes that are malformed should not cause
@@ -1437,8 +1447,8 @@ bgp_attr_malformed(struct bgp_attr_parser_args *args, uint8_t subcode,
 	    && CHECK_FLAG(flags, BGP_ATTR_FLAG_PARTIAL))
 		return BGP_ATTR_PARSE_WITHDRAW;
 
-	/* default to reset */
-	return BGP_ATTR_PARSE_ERROR_NOTIFYPLS;
+	return unhandled_attr ? BGP_ATTR_PARSE_WITHDRAW
+			      : BGP_ATTR_PARSE_ERROR_NOTIFYPLS;
 }
 
 /* Find out what is wrong with the path attribute flag bits and log the error.