Denis Ovsienko

The BPF interpreter fails to validate the register index when loading or storing values from or to a scratch memory register. While the index is an unsigned 32-bit integer that should not exceed 15, the lack of validation allows a crafted filter program to force reads and writes into process memory outside intended bounds. On 64-bit architectures, this can affect the 16GiB of memory starting at the current stack frame, and on 32-bit architectures, it can affect the entire address space.

The BPF interpreter fails to detect when the end of the filter program buffer is reached due to a missing return instruction, or when a jump instruction uses an offset that points outside the buffer. In specific uncommon scenarios, a crafted filter program can force the interpreter to read OS process memory within a 32GiB range around the buffer on 64-bit architectures, or across the entire address space on 32-bit architectures.

The BPF interpreter fails to verify if the immediate value is zero when processing 'div #k' and 'mod #k' ALU instructions. This allows a specially crafted filter program to trigger a division by zero error.

The issue affects the Quagga package, allowing remote attackers to exploit multiple vulnerabilities, potentially leading to disruption of confidentiality, integrity, and availability of protected information. The exploitation can be carried out remotely. Specifically, the `bgp capability orf` function in `bgpd` in Quagga 0.99.20.1 and earlier is vulnerable to a denial of service (assertion failure and daemon exit) by sending a malformed Outbound Route Filtering (ORF) capability TLV in an OPEN message, leveraging a BGP peering relationship.