CVE-2024-55553

What it actually does

Triggers full RIB re-validation and re-parsing whenever an RTR update batch exceeds the internal socket buffer (default 4K), enabling continuous re-validation loops and elevated BMP traffic when large numbers of ROA updates or withdrawals are sent during an update interval.

Why it matters to the business

Degrades route handling performance on FRR routers using RPKI, potentially requiring more than 30 minutes to re-validate large tables, leading to increased resource consumption and possible operational disruption for global routing infrastructure.

How an attack unfolds

An attacker sends continuous large batches of ROA updates and withdrawals over RTR to force repeated full-table re-validations on affected FRR instances; the condition can also occur organically but is amplified by the attacker to sustain performance impact and generate excess BMP traffic.

How to fix it

Upgrade to FRR 10.0.3, 10.1.2, 10.2.1 or 10.3 or later (commit 47cdfbda7640f9e10dc298cb98ea0411dc14e0ab) to correct the buffer-triggered re-validation logic.

How to confirm the fix worked

Confirm running version is at or above a fixed release, monitor RTR update sizes against socket buffer limits, and verify absence of repeated full-table re-validation events under normal RPKI load.

Typical attack path

1. Identify FRR instances using RPKI RTR
2. Establish RTR session and issue more than buffer-sized ROA updates/withdrawals within an update interval
3. Repeat issuance to maintain continuous re-validation pressure
4. Observe sustained high CPU, delayed route convergence, and elevated BMP traffic to ingestors

How to detect it

Search router logs and BMP collectors for repeated full RIB re-validation events, sustained high CPU during RPKI update windows, and anomalous spikes in BMP session traffic correlated with RTR activity.

What your security team should do

• Apply the listed fixed versions immediately on all FRR deployments using RPKI
• Prioritize routers with large full tables due to longer re-validation times
• Tune RTR update intervals and monitor BMP traffic for spikes indicating exploitation or organic triggers
• Review RPKI RTR sessions for unexpected large update volumes