BGP UPDATE message decoding uint16 underflow vulnerability analysis

Vulnerability Overview In the function, when a malformed UPDATE message is received, if the declared section length is less than the actual encoded element length, the subtraction causes or to wrap around to a large value. This leads to the loop silently consuming data beyond the section boundaries, resulting in potential security issues. Scope of Impact This vulnerability affects all systems that use the function to process BGP UPDATE messages. Attackers can cause the system to silently consume data beyond the expected range by sending specially crafted malformed UPDATE messages, which may lead to data leakage or other security issues. Remediation Add boundary checks before each subtraction operation to detect and reject such messages. Specific remediation measures include: 1. Add boundary checks for and when calculating and . 2. Return an error if or is greater than or . 3. Return an error if is less than or . POC Code The POC code included in the page is as follows: ```go func TestUpdateWithdrawRouteUnderflow(t testing.T) { // WithoutWithdrawRouteLen is 2, but the /32 prefix requires 5 bytes. // Without an underflow guard, routelen wraps from 2 to 65535 and the // loop silently consumes the entire remaining buffer as withdraw // routes, returning no error (silent data corruption). const underflow = 65535 // uint16(-5) buf := make([]byte, 2+underflow+5) buf[0], buf[1] = 0x00, 0x02 // WithdrawnRoutesLen = 2 buf[2] = 0x20 // /32 prefix length buf[3], buf[4], buf[5] = 10, 0, 0 // 10.0.0.0 // bytes 7..65539: 0x00, decoded as 65533 /0 prefixes // bytes 65540..65541: TotalPathAttributesLen = 0 u := &BGPUpdate{} err := u.DecodeFromBytes(buf) require.Error(t, err) } func TestUpdatePathAttrLenUnderflow(t testing.T) { // TotalPathAttributesLen is 3, but the ORIGIN attribute is 4 bytes. // Without an underflow guard, pathlen wraps from 3 to 65535 and the // loop silently consumes the filler bytes as path attributes, // returning no error (silent data corruption). // 65535 is divisible by 3 (filler attr size), so the loop exits // cleanly with pathlen0 instead of hitting the pathlen<3 guard. const underflow = 65535 // uint16(-3) const fillerAttrLen = 3 buf := make([]byte, 2+2+underflow) buf[0], buf[1] = 0x00, 0x00 // WithdrawnRoutesLen = 0 buf[2], buf[3] = 0x00, 0x03 // TotalPathAttributesLen = 3 buf[4], buf[5], buf[6], buf[7] = 0x00, 0x01, 0x00, 0x00 // ORIGIN[0] for i := 0; i < 2+2+underflow; i += fillerAttrLen { buf[i] = 0x00 // flags: optional + transitive buf[i+1] = 0xff // type: unknown buf[i+2] = 0x00 // length: 0 } u := &BGPUpdate{} err := u.DecodeFromBytes(buf) require.Error(t, err) } func TestFuzzCrashers(t *testing.T) { crashers := []string{ "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Goal Reached Thanks to every supporter — we hit 100%!

BGP UPDATE message decoding uint16 underflow vulnerability analysis

More from this source