Güvenlik Danışarlıklarına Dön

FRR Regression — Ubuntu Security Update (USN-7230-3)

USN-7230-3 fixes a regression in Ubuntu's earlier FRR update: the CVE-2024-55553 fix introduced a bug in RPKI support that stopped FRR processing RPKI updates after the first one, leaving routes unvalidated (CVE-2024-44070 context, CVSS 7.5). Update: sudo apt update && sudo apt upgrade frr and restart the frr service — this restores route validation while keeping the original security fix.

High 7.5 CVSS
Ubuntu 20.04 Ubuntu 22.04

SharedLicense lisansı altında bunun anlamı

Without RPKI updates processing, route-origin validation silently stops working — BGP routes the operator believes are validated are accepted unvalidated, reopening route-hijack exposure.

  1. Ubuntu Security Notices

  2. USN-7230-3

Publication date

5 November 2026

Overview

USN-7230-2 introduced a regression in FRR

Releases


24.04 LTS


22.04 LTS


20.04 LTS

Packages

  • frr – FRRouting suite of internet protocols

Details

USN-7230-2 fixed vulnerabilities in FRR. Unfortunately, the fix for
CVE-2024-55553 introduced a regression in RPKI support, causing FRR to stop
processing RPKI updates after the first one, so routes were not revalidated
when RPKI data changed. In Ubuntu 20.04 LTS, the BGP daemon also failed to
start when the RPKI module was enabled. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Iggy Frankovic discovered that FRR incorrectly handled certain BGP
messages. A remote attacker could possibly use this issue to cause FRR to
crash, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS. (CVE-2024-44070)

It was discovered that FRR re-validated all routes in certain instances
when the internal socket’s buffer size overflowed. A remote attacker could
possibly use this issue to…

USN-7230-2 fixed vulnerabilities in FRR. Unfortunately, the fix for
CVE-2024-55553 introduced a regression in RPKI support, causing FRR to stop
processing RPKI updates after the first one, so routes were not revalidated
when RPKI data changed. In Ubuntu 20.04 LTS, the BGP daemon also failed to
start when the RPKI module was enabled. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Iggy Frankovic discovered that FRR incorrectly handled certain BGP
messages. A remote attacker could possibly use this issue to cause FRR to
crash, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS. (CVE-2024-44070)

It was discovered that FRR re-validated all routes in certain instances
when the internal socket’s buffer size overflowed. A remote attacker could
possibly use this issue to impact the performance of FRR, resulting in a
denial of service. (CVE-2024-55553)

Show more
Show less

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
24.04

LTS noble

 frr-rpki-rtrlib – 

8.4.4-1.1ubuntu6.8
22.04

LTS jammy

 frr-rpki-rtrlib – 

8.1-1ubuntu1.17
20.04

LTS focal

 frr – 

7.2.1-1ubuntu0.2+esm5

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

frr-rpki-rtrlib – 

7.2.1-1ubuntu0.2+esm5

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

References

Related notices

Sıkça Sorulan Sorular

What is USN-7230-3?
It is Ubuntu's follow-up notice correcting a regression introduced by USN-7230-2's fix for CVE-2024-55553: FRR stopped processing RPKI updates after the first one, silently disabling route-origin validation. The follow-up restores RPKI processing while keeping the security fix (CVE-2024-44070 context, CVSS 7.5).
Who is affected?
Ubuntu servers running FRR with RPKI route-origin validation configured — BGP edge and core routers relying on RPKI to reject hijacked prefixes.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade frr and restart the frr service; then verify RPKI updates are being received and applied in your FRR logs.
Why does a security fix need its own follow-up?
The original fix changed how FRR processed updates and accidentally broke RPKI handling after the first message — a classic regression. This notice delivers the corrected implementation that keeps both the security fix and RPKI working.

Referanslar

Güvenlik Danışarlıkları

İlgili Danışarlıklar

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Sisteminizi güvenlik açıkları açısından kontrol edin

Size uygun tam düzeltme komutlarını görmek için ürününüzü ve işletim sisteminizi seçin.

Sisteminizi Kontrol Edin