CVE-2019-5892: Interpretation Conflict (CWE-436)
value: bgpd in FRRouting FRR (aka Free Range Routing) 2.x and 3.x before 3.0.4, 4.x before 4.0.1, 5.x before 5.0.2, and 6.x before 6.0.2 (not affecting Cumulus Linux or VyOS), when ENABLE_BGP_VNC is used for Virtual Network Control, allows remote attackers to cause a denial of service (peering session flap) via attribute 255 in a BGP UPDATE packet. This occurred during Disco in January 2019 because FRR does not implement RFC 7606, and therefore the packets with 255 were considered invalid VNC data and the BGP session was closed.
CWE description: Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
CVSS v3 base score: 6.5
Published: 2019-01-10T17:29Z
Repository: https://github.com/FRRouting/frr
Language: C
Files changed: bgpd/bgp_attr.c, bgpd/bgpd.h
Commit date: 2019-01-07 11:51:06 -0500
Commit message: bgpd: don't use BGP_ATTR_VNC(255) unless ENABLE_BGP_VNC_ATTR is defined

Signed-off-by: Lou Berger <lberger@labn.net>

Diff: diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
index 87ebb9c28..b990e99bd 100644
--- a/bgpd/bgp_attr.c
+++ b/bgpd/bgp_attr.c
@@ -76,11 +76,11 @@ static const struct message attr_str[] = {
 	{BGP_ATTR_AS4_PATH, "AS4_PATH"},
 	{BGP_ATTR_AS4_AGGREGATOR, "AS4_AGGREGATOR"},
 	{BGP_ATTR_AS_PATHLIMIT, "AS_PATHLIMIT"},
 	{BGP_ATTR_PMSI_TUNNEL, "PMSI_TUNNEL_ATTRIBUTE"},
 	{BGP_ATTR_ENCAP, "ENCAP"},
-#if ENABLE_BGP_VNC
+#if ENABLE_BGP_VNC_ATTR
 	{BGP_ATTR_VNC, "VNC"},
 #endif
 	{BGP_ATTR_LARGE_COMMUNITIES, "LARGE_COMMUNITY"},
 	{BGP_ATTR_PREFIX_SID, "PREFIX_SID"},
 	{0}};
@@ -2591,11 +2591,11 @@ bgp_attr_parse_ret_t bgp_attr_parse(struct peer *peer, struct attr *attr,
 			ret = bgp_mp_unreach_parse(&attr_args, mp_withdraw);
 			break;
 		case BGP_ATTR_EXT_COMMUNITIES:
 			ret = bgp_attr_ext_communities(&attr_args);
 			break;
-#if ENABLE_BGP_VNC
+#if ENABLE_BGP_VNC_ATTR
 		case BGP_ATTR_VNC:
 #endif
 		case BGP_ATTR_ENCAP:
 			ret = bgp_attr_encap(type, peer, length, attr, flag,
 					     startp);
@@ -2944,11 +2944,11 @@ static void bgp_packet_mpattr_tea(struct bgp *bgp, struct peer *peer,
 		 */
 		attrlenfield = 2 + 2; /* T + L */
 		attrhdrlen = 1 + 1;   /* subTLV T + L */
 		break;
 
-#if ENABLE_BGP_VNC
+#if ENABLE_BGP_VNC_ATTR
 	case BGP_ATTR_VNC:
 		attrname = "VNC";
 		subtlvs = attr->vnc_subtlvs;
 		if (subtlvs == NULL) /* nothing to do */
 			return;
@@ -3431,11 +3431,11 @@ bgp_size_t bgp_packet_attribute(struct bgp *bgp, struct peer *peer,
 	     && (safi == SAFI_ENCAP || safi == SAFI_MPLS_VPN))
 	    || (afi == AFI_L2VPN && safi == SAFI_EVPN)) {
 		/* Tunnel Encap attribute */
 		bgp_packet_mpattr_tea(bgp, peer, s, attr, BGP_ATTR_ENCAP);
 
-#if ENABLE_BGP_VNC
+#if ENABLE_BGP_VNC_ATTR
 		/* VNC attribute */
 		bgp_packet_mpattr_tea(bgp, peer, s, attr, BGP_ATTR_VNC);
 #endif
 	}
 
diff --git a/bgpd/bgpd.h b/bgpd/bgpd.h
index 62096d651..f28ca9fa0 100644
--- a/bgpd/bgpd.h
+++ b/bgpd/bgpd.h
@@ -1278,11 +1278,11 @@ struct bgp_nlri {
 #define BGP_ATTR_AS_PATHLIMIT                   21
 #define BGP_ATTR_PMSI_TUNNEL                    22
 #define BGP_ATTR_ENCAP                          23
 #define BGP_ATTR_LARGE_COMMUNITIES              32
 #define BGP_ATTR_PREFIX_SID                     40
-#if ENABLE_BGP_VNC
+#if ENABLE_BGP_VNC_ATTR
 #define BGP_ATTR_VNC                           255
 #endif
 
 /* BGP update origin.  */
 #define BGP_ORIGIN_IGP                           0

Vulnerable code: #if ENABLE_BGP_VNC
#if ENABLE_BGP_VNC
#if ENABLE_BGP_VNC
#if ENABLE_BGP_VNC
#if ENABLE_BGP_VNC
Fixed code: #if ENABLE_BGP_VNC_ATTR
#if ENABLE_BGP_VNC_ATTR
#if ENABLE_BGP_VNC_ATTR
#if ENABLE_BGP_VNC_ATTR
#if ENABLE_BGP_VNC_ATTR