CVE-2022-42917

EUVD-2022-56059
In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/etc/frr) and replacing config files upon creation with, for example, symlinks to change the ownership of arbitrary files. This is a TOCTOU Race Condition caused by a combination of touch and chown.
TOCTOU
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
6.7 MEDIUM
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
frroutingfrrouting
𝑥
< 4.5
CNA
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
frr
suse enterprise sap 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP7
10.2.1-150700.1.7
fixed
suse enterprise server 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP7
10.2.1-150700.1.7
fixed
frr-devel
suse enterprise sap 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP7
10.2.1-150700.1.7
fixed
suse enterprise server 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP7
10.2.1-150700.1.7
fixed
libfrr0
suse enterprise sap 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP7
10.2.1-150700.1.7
fixed
suse enterprise server 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP7
10.2.1-150700.1.7
fixed
libfrr_pb0
suse enterprise sap 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP7
10.2.1-150700.1.7
fixed
suse enterprise server 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP7
10.2.1-150700.1.7
fixed
libfrrcares0
suse enterprise sap 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP7
10.2.1-150700.1.7
fixed
suse enterprise server 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP7
10.2.1-150700.1.7
fixed
libfrrfpm_pb0
suse enterprise sap 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP7
10.2.1-150700.1.7
fixed
suse enterprise server 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP7
10.2.1-150700.1.7
fixed
libfrrgrpc_pb0
suse enterprise sap 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP4
7.4-150300.4.10.1
fixed
libfrrospfapiclient0
suse enterprise sap 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP7
10.2.1-150700.1.7
fixed
suse enterprise server 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP7
10.2.1-150700.1.7
fixed
libfrrsnmp0
suse enterprise sap 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP7
10.2.1-150700.1.7
fixed
suse enterprise server 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP7
10.2.1-150700.1.7
fixed
libfrrzmq0
suse enterprise sap 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP7
10.2.1-150700.1.7
fixed
suse enterprise server 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP7
10.2.1-150700.1.7
fixed
libmgmt_be_nb0
suse enterprise sap 15 SP7
10.2.1-150700.1.7
fixed
suse enterprise server 15 SP7
10.2.1-150700.1.7
fixed
libmlag_pb0
suse enterprise sap 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise sap 15 SP7
8.5.6-150500.4.30.1
fixed
suse enterprise server 15 SP3
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP4
7.4-150300.4.10.1
fixed
suse enterprise server 15 SP7
8.5.6-150500.4.30.1
fixed
Common Weakness Enumeration
References
https://bugzilla.suse.com/show_bug.cgi?id=1204124
https://frrouting.org/security/cve-2022-42917/
https://github.com/FRRouting/frr/commit/972cdc560e339d70c0ee5fb70ec636ab78f00bca
https://github.com/FRRouting/frr/compare/frr-8.4...frr-8.5