Skip to content

Commit 5bbe743

Browse files
CBL-Mariner-BotKanishk-BansalKanishk Bansal
authored
[AUTO-CHERRYPICK] Patch frr for CVE-2024-55553 [High] - branch main (#14006)
Signed-off-by: Kanishk Bansal <[email protected]> Co-authored-by: Kanishk Bansal <[email protected]> Co-authored-by: Kanishk Bansal <[email protected]>
1 parent a200b77 commit 5bbe743

File tree

2 files changed

+237
-1
lines changed

2 files changed

+237
-1
lines changed

‎SPECS/frr/CVE-2024-55553.patch

Lines changed: 231 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,231 @@
1+
From ace70f308966d2a4fbb8528dab12521ecf215a2f Mon Sep 17 00:00:00 2001
2+
From: Kanishk Bansal <[email protected]>
3+
Date: Fri, 13 Jun 2025 11:10:28 +0000
4+
Subject: [PATCH] Backport CVE-2024-55553
5+
6+
Upstream Reference : https://github.com/opensourcerouting/frr/commit/cc1c66a7e8dd31c681f396f6635192c0d60a543c
7+
8+
Signed-off-by: Kanishk Bansal <[email protected]>
9+
---
10+
bgpd/bgp_rpki.c | 120 +++++++++++++++++++-----------------------------
11+
bgpd/bgpd.c | 4 --
12+
bgpd/bgpd.h | 1 -
13+
3 files changed, 48 insertions(+), 77 deletions(-)
14+
15+
diff --git a/bgpd/bgp_rpki.c b/bgpd/bgp_rpki.c
16+
index 73c6fe0..958867c 100644
17+
--- a/bgpd/bgp_rpki.c
18+
+++ b/bgpd/bgp_rpki.c
19+
@@ -64,6 +64,10 @@ DEFINE_MTYPE_STATIC(BGPD, BGP_RPKI_CACHE_GROUP, "BGP RPKI Cache server group");
20+
DEFINE_MTYPE_STATIC(BGPD, BGP_RPKI_RTRLIB, "BGP RPKI RTRLib");
21+
DEFINE_MTYPE_STATIC(BGPD, BGP_RPKI_REVALIDATE, "BGP RPKI Revalidation");
22+
23+
+#define RPKI_VALID 1
24+
+#define RPKI_NOTFOUND 2
25+
+#define RPKI_INVALID 3
26+
+
27+
#define POLLING_PERIOD_DEFAULT 3600
28+
#define EXPIRE_INTERVAL_DEFAULT 7200
29+
#define RETRY_INTERVAL_DEFAULT 600
30+
@@ -123,7 +127,6 @@ static void print_record(const struct pfx_record *record, struct vty *vty,
31+
json_object *json);
32+
static bool is_synchronized(void);
33+
static bool is_running(void);
34+
-static bool is_stopping(void);
35+
static void route_match_free(void *rule);
36+
static enum route_map_cmd_result_t route_match(void *rule,
37+
const struct prefix *prefix,
38+
@@ -131,7 +134,6 @@ static enum route_map_cmd_result_t route_match(void *rule,
39+
void *object);
40+
static void *route_match_compile(const char *arg);
41+
static void revalidate_bgp_node(struct bgp_dest *dest, afi_t afi, safi_t safi);
42+
-static void revalidate_all_routes(void);
43+
44+
static struct rtr_mgr_config *rtr_config;
45+
static struct list *cache_list;
46+
@@ -367,11 +369,6 @@ inline bool is_running(void)
47+
return rtr_is_running;
48+
}
49+
50+
-inline bool is_stopping(void)
51+
-{
52+
- return rtr_is_stopping;
53+
-}
54+
-
55+
static void pfx_record_to_prefix(struct pfx_record *record,
56+
struct prefix *prefix)
57+
{
58+
@@ -415,36 +412,10 @@ static void rpki_revalidate_prefix(struct thread *thread)
59+
XFREE(MTYPE_BGP_RPKI_REVALIDATE, rrp);
60+
}
61+
62+
-static void bgpd_sync_callback(struct thread *thread)
63+
+static void revalidate_single_prefix(struct prefix prefix, afi_t afi)
64+
{
65+
struct bgp *bgp;
66+
struct listnode *node;
67+
- struct prefix prefix;
68+
- struct pfx_record rec;
69+
-
70+
- thread_add_read(bm->master, bgpd_sync_callback, NULL,
71+
- rpki_sync_socket_bgpd, NULL);
72+
-
73+
- if (atomic_load_explicit(&rtr_update_overflow, memory_order_seq_cst)) {
74+
- while (read(rpki_sync_socket_bgpd, &rec,
75+
- sizeof(struct pfx_record)) != -1)
76+
- ;
77+
-
78+
- atomic_store_explicit(&rtr_update_overflow, 0,
79+
- memory_order_seq_cst);
80+
- revalidate_all_routes();
81+
- return;
82+
- }
83+
-
84+
- int retval =
85+
- read(rpki_sync_socket_bgpd, &rec, sizeof(struct pfx_record));
86+
- if (retval != sizeof(struct pfx_record)) {
87+
- RPKI_DEBUG("Could not read from rpki_sync_socket_bgpd");
88+
- return;
89+
- }
90+
- pfx_record_to_prefix(&rec, &prefix);
91+
-
92+
- afi_t afi = (rec.prefix.ver == LRTR_IPV4) ? AFI_IP : AFI_IP6;
93+
94+
for (ALL_LIST_ELEMENTS_RO(bm->bgp, node, bgp)) {
95+
safi_t safi;
96+
@@ -467,6 +438,48 @@ static void bgpd_sync_callback(struct thread *thread)
97+
}
98+
}
99+
100+
+static void bgpd_sync_callback(struct thread *thread)
101+
+{
102+
+ struct prefix prefix;
103+
+ struct pfx_record rec;
104+
+ afi_t afi;
105+
+ int retval;
106+
+
107+
+ if (atomic_load_explicit(&rtr_update_overflow, memory_order_seq_cst)) {
108+
+ ssize_t size = 0;
109+
+
110+
+ retval = read(rpki_sync_socket_bgpd, &rec,
111+
+ sizeof(struct pfx_record));
112+
+ while (retval != -1) {
113+
+ if (retval != sizeof(struct pfx_record))
114+
+ break;
115+
+
116+
+ size += retval;
117+
+ pfx_record_to_prefix(&rec, &prefix);
118+
+ afi = (rec.prefix.ver == LRTR_IPV4) ? AFI_IP : AFI_IP6;
119+
+ revalidate_single_prefix(prefix, afi);
120+
+
121+
+ retval = read(rpki_sync_socket_bgpd, &rec,
122+
+ sizeof(struct pfx_record));
123+
+ }
124+
+
125+
+ atomic_store_explicit(&rtr_update_overflow, 0,
126+
+ memory_order_seq_cst);
127+
+ return;
128+
+ }
129+
+
130+
+ retval = read(rpki_sync_socket_bgpd, &rec, sizeof(struct pfx_record));
131+
+ if (retval != sizeof(struct pfx_record)) {
132+
+ RPKI_DEBUG("Could not read from rpki_sync_socket_bgpd");
133+
+ return;
134+
+ }
135+
+ pfx_record_to_prefix(&rec, &prefix);
136+
+
137+
+ afi = (rec.prefix.ver == LRTR_IPV4) ? AFI_IP : AFI_IP6;
138+
+
139+
+ revalidate_single_prefix(prefix, afi);
140+
+}
141+
+
142+
static void revalidate_bgp_node(struct bgp_dest *bgp_dest, afi_t afi,
143+
safi_t safi)
144+
{
145+
@@ -514,48 +527,11 @@ static void bgp_rpki_revalidate_peer(struct thread *thread)
146+
XFREE(MTYPE_BGP_RPKI_REVALIDATE, rvp);
147+
}
148+
149+
-static void revalidate_all_routes(void)
150+
-{
151+
- struct bgp *bgp;
152+
- struct listnode *node;
153+
-
154+
- for (ALL_LIST_ELEMENTS_RO(bm->bgp, node, bgp)) {
155+
- struct peer *peer;
156+
- struct listnode *peer_listnode;
157+
-
158+
- for (ALL_LIST_ELEMENTS_RO(bgp->peer, peer_listnode, peer)) {
159+
- afi_t afi;
160+
- safi_t safi;
161+
-
162+
- FOREACH_AFI_SAFI (afi, safi) {
163+
- struct rpki_revalidate_peer *rvp;
164+
-
165+
- if (!bgp->rib[afi][safi])
166+
- continue;
167+
-
168+
- if (!peer_established(peer))
169+
- continue;
170+
-
171+
- rvp = XCALLOC(MTYPE_BGP_RPKI_REVALIDATE,
172+
- sizeof(*rvp));
173+
- rvp->peer = peer;
174+
- rvp->afi = afi;
175+
- rvp->safi = safi;
176+
-
177+
- thread_add_event(
178+
- bm->master, bgp_rpki_revalidate_peer,
179+
- rvp, 0,
180+
- &peer->t_revalidate_all[afi][safi]);
181+
- }
182+
- }
183+
- }
184+
-}
185+
-
186+
static void rpki_update_cb_sync_rtr(struct pfx_table *p __attribute__((unused)),
187+
const struct pfx_record rec,
188+
const bool added __attribute__((unused)))
189+
{
190+
- if (is_stopping() ||
191+
+ if (rtr_is_stopping ||
192+
atomic_load_explicit(&rtr_update_overflow, memory_order_seq_cst))
193+
return;
194+
195+
diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c
196+
index 1423529..e93cc7b 100644
197+
--- a/bgpd/bgpd.c
198+
+++ b/bgpd/bgpd.c
199+
@@ -1167,8 +1167,6 @@ static void peer_free(struct peer *peer)
200+
bgp_reads_off(peer);
201+
bgp_writes_off(peer);
202+
thread_cancel_event_ready(bm->master, peer);
203+
- FOREACH_AFI_SAFI (afi, safi)
204+
- THREAD_OFF(peer->t_revalidate_all[afi][safi]);
205+
assert(!peer->t_write);
206+
assert(!peer->t_read);
207+
BGP_EVENT_FLUSH(peer);
208+
@@ -2535,8 +2533,6 @@ int peer_delete(struct peer *peer)
209+
bgp_reads_off(peer);
210+
bgp_writes_off(peer);
211+
thread_cancel_event_ready(bm->master, peer);
212+
- FOREACH_AFI_SAFI (afi, safi)
213+
- THREAD_OFF(peer->t_revalidate_all[afi][safi]);
214+
assert(!CHECK_FLAG(peer->thread_flags, PEER_THREAD_WRITES_ON));
215+
assert(!CHECK_FLAG(peer->thread_flags, PEER_THREAD_READS_ON));
216+
assert(!CHECK_FLAG(peer->thread_flags, PEER_THREAD_KEEPALIVES_ON));
217+
diff --git a/bgpd/bgpd.h b/bgpd/bgpd.h
218+
index 2c35c2a..675da29 100644
219+
--- a/bgpd/bgpd.h
220+
+++ b/bgpd/bgpd.h
221+
@@ -1517,7 +1517,6 @@ struct peer {
222+
struct thread *t_gr_restart;
223+
struct thread *t_gr_stale;
224+
struct thread *t_llgr_stale[AFI_MAX][SAFI_MAX];
225+
- struct thread *t_revalidate_all[AFI_MAX][SAFI_MAX];
226+
struct thread *t_generate_updgrp_packets;
227+
struct thread *t_process_packet;
228+
struct thread *t_process_packet_error;
229+
--
230+
2.45.3
231+

‎SPECS/frr/frr.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Summary: Routing daemon
44
Name: frr
55
Version: 8.5.5
6-
Release: 2%{?dist}
6+
Release: 3%{?dist}
77
License: GPL-2.0-or-later
88
Vendor: Microsoft Corporation
99
Distribution: Mariner
@@ -17,6 +17,8 @@ Patch2: 0002-disable-eigrp-crypto.patch
1717
Patch3: 0003-fips-mode.patch
1818
Patch4: 0004-remove-grpc-test.patch
1919
Patch5: CVE-2024-44070.patch
20+
Patch6: CVE-2024-55553.patch
21+
2022
BuildRequires: autoconf
2123
BuildRequires: automake
2224
BuildRequires: bison
@@ -198,6 +200,9 @@ rm tests/lib/*grpc*
198200
%{_sysusersdir}/%{name}.conf
199201

200202
%changelog
203+
* Fri Jun 13 2025 Kanishk Bansal <[email protected]> - 8.5.5-3
204+
- Backport Patch CVE-2024-55553
205+
201206
* Wed Aug 21 2024 Brian Fjeldstad <[email protected]> - 8.5.5-2
202207
- Patch CVE-2024-44070
203208

0 commit comments

Comments
 (0)