BIRD BGP RFC 8203 Stack Overflow Vulnerability Analysis

Key Information Summary Vulnerability Description Vulnerability Type: Stack Overflow. Vulnerability Context: The vulnerability exists in BIRD, which supports the BGP protocol, specifically in RFC 8203 (BGP administrative shutdown message handling) since commit . Target of the Issue: Attackers can overflow a fixed-size stack buffer by crafting a malicious RFC 8203 BGP administrative shutdown message. Affected Versions Affected BIRD Versions: BIRD ≥ 1.6.4 and BIRD ≥ 2.0.0. Vulnerability Analysis and Reproduction 1. Memory Leak Reproduction: By crafting a shutdown message of specific length (255 bytes) under RFC 8203, where the message itself is absent and and . 2. Stack Overflow Reproduction: Successfully triggered stack overflow by constructing an RFC 8203 shutdown message with length exceeding 252 bytes, overflowing into adjacent stack memory area near . Root Cause The function failed to properly validate when processing RFC 8203 shutdown messages, leading to out-of-bounds memory writes. The function did not correctly account for during formatted string processing, resulting in memory overflow. Mitigation Measures Modified the length check condition in the function, adjusting the handling of to prevent out-of-bounds access and overflow. A fix patch has been provided and applied to the latest versions of BIRD. Contact Information Reporter: Daniel McCarney (cpu@letsencrypt.org) Discovery Date: Sun Sep 8 19:59:03 CEST 2019 ```diff --- a/proto/bgp/packets.c 2019-09-08 19:59:03 -0500 +++ b/proto/bgp/packets.c 2019-09-08 19:59:03 -0500 @@ -258,10 +258,10 @@ return -1; } if (msg_len+1 > len) if ((msg_len >= 252) && ((msg_len+1) > len)) return -1; / Allow empty messages / / Check proper message / if (msg_len > 255) return -1;

Goal Reached Thanks to every supporter — we hit 100%!

BIRD BGP RFC 8203 Stack Overflow Vulnerability Analysis