Route to Bugs: Analyzing the Security of BGP Message Parsing
summary
Analysis targets popular BGP stacks, runs a custom fuzzer against open and update parsing, and finds 3 new CVEs in an FRRouting-derived implementation; all three cause denial-of-service by reading past packet bounds, two of which trigger before peering so an attacker can spoof a source IP. The research tests seven implementations, hits issues in one, notes ~330,000 BGP hosts on IPv4 and over a thousand FRRouting instances, and publishes tools and testcases.
AI-written summary · about
chapters (10)
- 0:00Introduction to bgp research
- 2:16Modern bgp use cases
- 5:27Bgp vulnerabilities and risks
- 7:57Analyzing historical attacks
- 12:50Threat landscape and exposure
- 16:22Fuzzing methodology
- 22:00Vulnerability findings
- 24:48Technical breakdown of bugs
- 27:41Impact and supply chain issues
- 32:10Mitigation and conclusions
related talks
22mBGP Vortex: Update Message Floods Can Create Internet Instabilities
21mStealth BGP Hijacks with uRPF Filtering
29mHow Protocol Gateways May Introduce More Problems than They Solve
12mxBGP: Faster Innovation in Routing Protocols
32mLet's talk about routing security
16mA System to Detect Forged-Origin BGP Hijacks
27mWIFI-Important Remote Attack Surface: Threat is Expanding
01mFrom Bugs to Breaches