A NULL pointer dereference flaw in FRRouting versions 2.0 through 10.4.1 presents a critical availability risk by allowing unauthenticated attackers to crash the service.

The software contains a NULL pointer dereference vulnerability within the ospf_opaque_lsa_dump function in the ospf_opaque.c file. This flaw is reachable by unauthenticated remote attackers who can send specifically crafted Link State Advertisement (LSA) packets to cause a service crash.

Successful exploitation of this vulnerability results in a Denial of Service condition, disrupting routing operations and network availability. Given the CVSS score of 7.5, the impact is significant for environments relying on FRRouting for critical network infrastructure. Downtime caused by this flaw can lead to severe operational disruption and loss of network connectivity.

Immediate Action: Upgrade to a version of FRRouting that incorporates the fix provided in commit 88f5c06cbc1cc4d62e1cba3e7791f5cea4179ba5.

Proactive Monitoring: Monitor system logs and OSPF process health for sudden service termination or repeated restart cycles indicative of crash conditions.

Compensating Controls: Implement network access control lists (ACLs) to restrict OSPF traffic to trusted peers only, thereby limiting the exposure of the vulnerable OSPF implementation to unauthorized sources.

Public Exploit Available: Yes — a technical write-up detailing the vulnerability and trigger mechanism is available at the provided GitHub reference.

The vulnerability poses a clear and immediate risk to network stability due to its ability to be triggered remotely without authentication. Security teams should prioritize patching affected routing instances to the latest stable release to prevent potential service outages. If immediate patching is not feasible, restrict OSPF communication channels to known, authenticated peers to mitigate the attack surface.