Back to Security Advisories

FRR Regression — Ubuntu Security Update (USN-7230-3)

USN-7230-3 fixes a regression in Ubuntu's earlier FRR update: the CVE-2024-55553 fix introduced a bug in RPKI support that stopped FRR processing RPKI updates after the first one, leaving routes unvalidated (CVE-2024-44070 context, CVSS 7.5). Update: sudo apt update && sudo apt upgrade frr and restart the frr service — this restores route validation while keeping the original security fix.

High 7.5 CVSS
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

Without RPKI updates processing, route-origin validation silently stops working — BGP routes the operator believes are validated are accepted unvalidated, reopening route-hijack exposure.

  1. Ubuntu Security Notices

  2. USN-7230-3

Publication date

5 November 2026

Overview

USN-7230-2 introduced a regression in FRR

Releases


24.04 LTS


22.04 LTS


20.04 LTS

Packages

  • frr – FRRouting suite of internet protocols

Details

USN-7230-2 fixed vulnerabilities in FRR. Unfortunately, the fix for
CVE-2024-55553 introduced a regression in RPKI support, causing FRR to stop
processing RPKI updates after the first one, so routes were not revalidated
when RPKI data changed. In Ubuntu 20.04 LTS, the BGP daemon also failed to
start when the RPKI module was enabled. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Iggy Frankovic discovered that FRR incorrectly handled certain BGP
messages. A remote attacker could possibly use this issue to cause FRR to
crash, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS. (CVE-2024-44070)

It was discovered that FRR re-validated all routes in certain instances
when the internal socket’s buffer size overflowed. A remote attacker could
possibly use this issue to…

USN-7230-2 fixed vulnerabilities in FRR. Unfortunately, the fix for
CVE-2024-55553 introduced a regression in RPKI support, causing FRR to stop
processing RPKI updates after the first one, so routes were not revalidated
when RPKI data changed. In Ubuntu 20.04 LTS, the BGP daemon also failed to
start when the RPKI module was enabled. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Iggy Frankovic discovered that FRR incorrectly handled certain BGP
messages. A remote attacker could possibly use this issue to cause FRR to
crash, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS. (CVE-2024-44070)

It was discovered that FRR re-validated all routes in certain instances
when the internal socket’s buffer size overflowed. A remote attacker could
possibly use this issue to impact the performance of FRR, resulting in a
denial of service. (CVE-2024-55553)

Show more
Show less

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
24.04

LTS noble

 frr-rpki-rtrlib – 

8.4.4-1.1ubuntu6.8
22.04

LTS jammy

 frr-rpki-rtrlib – 

8.1-1ubuntu1.17
20.04

LTS focal

 frr – 

7.2.1-1ubuntu0.2+esm5

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

frr-rpki-rtrlib – 

7.2.1-1ubuntu0.2+esm5

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

References

Related notices

Frequently Asked Questions

What is USN-7230-3?
It is Ubuntu's follow-up notice correcting a regression introduced by USN-7230-2's fix for CVE-2024-55553: FRR stopped processing RPKI updates after the first one, silently disabling route-origin validation. The follow-up restores RPKI processing while keeping the security fix (CVE-2024-44070 context, CVSS 7.5).
Who is affected?
Ubuntu servers running FRR with RPKI route-origin validation configured — BGP edge and core routers relying on RPKI to reject hijacked prefixes.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade frr and restart the frr service; then verify RPKI updates are being received and applied in your FRR logs.
Why does a security fix need its own follow-up?
The original fix changed how FRR processed updates and accidentally broke RPKI handling after the first message — a classic regression. This notice delivers the corrected implementation that keeps both the security fix and RPKI working.

References

Security Advisories

Related Advisories

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System