CZ.NIC BIRD Internet Routing Daemon (BGP AS_PATH mask matching): Stack-based buffer overflow in BIRD's AS_PATH mask

Impact

Stack-based buffer overflow in BIRD's AS_PATH mask matching: as_path_match() uses a fixed 2049-entry stack array while the parsed path can exceed it. BIRD is a common choice for route servers, for BGP-to-the-host designs, and inside open networking stacks — including some SONiC and Linux-router-based cluster underlays. A stack overflow in the BGP path-attribute parser is reachable from any peer, and in a route-reflector topology from beyond the direct peer.

Who can reach it

A BGP peer, or anything upstream of one whose AS_PATH propagates, sending a long AS_PATH that hits the mask-matching path. Requires a BGP filter using AS path masks.

What to do

Upgrade BIRD past 2.19.0 and restart the daemon — package upgrade plus service restart, which briefly drops BGP sessions and reconverges. Interim: apply an inbound AS_PATH length limit on every eBGP session, a live config change and sound policy regardless.

References