In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's buffer size, default 4K on most OSes. An attacker can use this to trigger re-parsing of the RIB for FRR routers using RTR by causing more than this number of updates during an update interval (usually 30 minutes). Additionally, this effect regularly occurs organically. Furthermore, an attacker can use this to trigger route validation continuously. Given that routers with large full tables may need more than 30 minutes to fully re-validate the table, continuous issuance/withdrawal of large numbers of ROA may be used to impact the route handling performance of all FRR instances using RPKI globally. Additionally, the re-validation will cause heightened BMP traffic to ingestors. Fixed Versions: 10.0.3, 10.1.2, 10.2.1, >= 10.3.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:03453-1 advisory.

    - CVE-2024-55553: excessive resource consumption may lead to denial of service due to repeated RIB     revalidation when       processing several RPKI updates (bsc#1235237).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:03297-1 advisory.

    - CVE-2024-55553: excessive resource consumption may lead to denial of service due to repeated RIB     revalidation when       processing several RPKI updates (bsc#1235237).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of frr installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-55553 advisory.

  - In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update     received via RTR exceeds the internal socket's buffer size, default 4K on most OSes. An attacker can use     this to trigger re-parsing of the RIB for FRR routers using RTR by causing more than this number of     updates during an update interval (usually 30 minutes). Additionally, this effect regularly occurs     organically. Furthermore, an attacker can use this to trigger route validation continuously. Given that     routers with large full tables May need more than 30 minutes to fully re-validate the table, continuous     issuance/withdrawal of large numbers of ROA May be used to impact the route handling performance of all     FRR instances using RPKI globally. Additionally, the re-validation will cause heightened BMP traffic to     ingestors. Fixed Versions: 10.0.3, 10.1.2, 10.2.1, >= 10.3. (CVE-2024-55553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of frr installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-55553 advisory.

  - In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update     received via RTR exceeds the internal socket's buffer size, default 4K on most OSes. An attacker can use     this to trigger re-parsing of the RIB for FRR routers using RTR by causing more than this number of     updates during an update interval (usually 30 minutes). Additionally, this effect regularly occurs     organically. Furthermore, an attacker can use this to trigger route validation continuously. Given that     routers with large full tables May need more than 30 minutes to fully re-validate the table, continuous     issuance/withdrawal of large numbers of ROA May be used to impact the route handling performance of all     FRR instances using RPKI globally. Additionally, the re-validation will cause heightened BMP traffic to     ingestors. Fixed Versions: 10.0.3, 10.1.2, 10.2.1, >= 10.3. (CVE-2024-55553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update     received via RTR exceeds the internal socket's buffer size, default 4K on most OSes. An attacker can use     this to trigger re-parsing of the RIB for FRR routers using RTR by causing more than this number of     updates during an update interval (usually 30 minutes). Additionally, this effect regularly occurs     organically. Furthermore, an attacker can use this to trigger route validation continuously. Given that     routers with large full tables may need more than 30 minutes to fully re-validate the table, continuous     issuance/withdrawal of large numbers of ROA may be used to impact the route handling performance of all     FRR instances using RPKI globally. Additionally, the re-validation will cause heightened BMP traffic to     ingestors. Fixed Versions: 10.0.3, 10.1.2, 10.2.1, >= 10.3. (CVE-2024-55553)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the frr package has been released.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7230-2 advisory.

    Iggy Frankovic discovered that FRR incorrectly handled certain BGP messages. A remote attacker could     possibly use this issue to cause FRR to crash, resulting in a denial of service. This issue only affected     Ubuntu 20.04 LTS. (CVE-2024-44070)

    It was discovered that FRR re-validated all routes in certain instances when the internal socket's buffer     size overflowed. A remote attacker could possibly use this issue to impact the performance of FRR,     resulting in a denial of service. (CVE-2024-55553)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4029 advisory.

    -lts-announce@lists.debian.org     Subject: [SECURITY] [DLA 4029-1] frr security update

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4029-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/              Arturo Borrero Gonzalez     January 23, 2025                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : frr     Version        : 7.5.1-1.1+deb11u4     CVE ID         : CVE-2024-55553

    In FRR, the internet routing protocol suite software, all routes are     re-validated if the total size of an update received via RTR exceeds the     internal socket's buffer size, default 4K on most OSes.

    An attacker can use this to trigger re-parsing of the RIB for FRR routers     using RTR by causing more than this number of updates during an update     interval (usually 30 minutes). Additionally, this effect regularly occurs     organically. Furthermore, an attacker can use this to trigger route validation     continuously. Given that routers with large full tables may need more than     30 minutes to fully re-validate the table, continuous issuance/withdrawal of     large numbers of ROA may be used to impact the route handling performance of     all FRR instances using RPKI globally. Additionally, the re-validation will     cause heightened BMP traffic to ingestors.

    For Debian 11 bullseye, this problem has been fixed in version     7.5.1-1.1+deb11u4.

    We recommend that you upgrade your frr packages.

    For the detailed security status of frr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/frr

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
266604	SUSE SLES15 / openSUSE 15 Security Update : frr (SUSE-SU-2025:03453-1)	Nessus	SuSE Local Security Checks	high
265770	SUSE SLES12 Security Update : frr (SUSE-SU-2025:03297-1)	Nessus	SuSE Local Security Checks	high
241930	CBL Mariner 2.0 Security Update: frr (CVE-2024-55553)	Nessus	MarinerOS Local Security Checks	high
241916	Azure Linux 3.0 Security Update: frr (CVE-2024-55553)	Nessus	Azure Linux Local Security Checks	high
230475	Linux Distros Unpatched Vulnerability : CVE-2024-55553	Nessus	Misc.	high
215204	Photon OS 5.0: Frr PHSA-2025-5.0-0462	Nessus	PhotonOS Local Security Checks	high
214670	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : FRR vulnerabilities (USN-7230-2)	Nessus	Ubuntu Local Security Checks	high
214524	Debian dla-4029 : frr - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2024-55553

high

Tenable Plugins

high

high

high

high

high

high

high

high