CVE-2018-5378

What it actually does

Improper bounds checking on attribute length in BGP NOTIFY messages allows out-of-bounds memory access in bgpd, resulting in either arbitrary process memory disclosure to a peer or a daemon crash.

Why it matters to the business

Routing daemons on Linux systems may leak sensitive memory contents or suffer denial-of-service, disrupting network reachability and requiring emergency restarts of critical infrastructure components.

How an attack unfolds

An attacker establishes a BGP peering session or spoofs one, then transmits a crafted NOTIFY message containing an invalid attribute length; bgpd reads beyond the intended buffer, sending process memory to the peer or crashing the daemon.

How to fix it

Upgrade Quagga bgpd to the fixed versions provided by each distribution: Debian 11/12/13 to 4.0.2-1; Ubuntu 14.04 LTS packages to the listed 3.13.0-149.199 or 4.4.0-13.29~14.04.1 equivalents; Ubuntu 16.04/18.04 LTS packages to the listed 4.2.0-16.19, 4.4.0-1001.10, 4.8.0-36.36~16.04.1, 4.10.0-1004.4, 4.11.0-1009.9, 4.13.0-1008.9, 4.15.0-1001.1/1002.2/1002.3 or 4.15.0-1023.24~14.04.1 equivalents as applicable per package.

How to confirm the fix worked

Verify installed bgpd version against the distribution-specific fixed package list; confirm absence of the vulnerable code path by inspecting the NOTIFY attribute length handling in source or by running regression tests that send malformed NOTIFY messages.

Typical attack path

1. Obtain or simulate a BGP peering relationship with the target Quagga instance
2. Craft and send a NOTIFY message with an oversized or negative attribute length field
3. Observe either memory contents returned in subsequent packets or daemon termination
4. Repeat or chain with other BGP state manipulation to prolong impact

How to detect it

Review bgpd logs and system crash reports for segmentation faults or aborts immediately following receipt of NOTIFY messages; inspect network captures for BGP NOTIFY PDUs with suspicious attribute length values; correlate with peer IP addresses that recently established sessions.

• bgpd: received NOTIFY.*invalid attribute length
• segfault.*bgpd
• BGP NOTIFY message with attribute length > declared size

What your security team should do

• Immediately apply the listed fixed packages on all affected Debian and Ubuntu systems running Quagga
• Disable or restrict BGP peering to trusted neighbors only until patches are deployed
• Monitor for bgpd process restarts and anomalous NOTIFY traffic in the interim