At last, a blog post that has been in the works for a while. Something that started as a small investigation and uncovered what I believe to be potentially near internet breaking flaws in how some BGP implementations works. This is: CVE-2023-4481 (Juniper), CVE-2023-38802 (FRR), CVE-2023-38283 (OpenBSD), CVE-2023-40457 (EXOS) "Grave flaws in BGP Error handling" https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling
one honk maybe more
benjojo
replied 29 Aug 2023 12:02 +0000
in reply to: https://layer8.space/users/mark22k/statuses/110972777855251964
@mark22k I don't really know what is public with FRR. I shared it with someone at FRR over email, who seems to have tried to share it with the rest of the project. But I've not really heard anything from FRR since