Summary ------- The CVE-2024-55553 security updates ("bgpd: Validate only affected RPKI prefixes instead of a full RIB") were derived from an unofficial upstream backport for FRR 7.5 (FRRouting/frr commit 2fa79333, never merged into any upstream branch). That backport removes the thread_add_read() call at the top of bgpd_sync_ callback( ) in bgpd/bgp_rpki.c and does not re-add it. The upstream fix (b0800bfdf04b) and its stable/10.x backports keep the re-arm.
As a result, bgpd reads a single record from the internal RTR-to-bgpd socket after start-up and never reads it again. Changes to the RPKI VRP set are no longer applied to routes already received.
On focal (ESM Apps), the backport additionally calls functions that do not exist in FRR 7.2.1 (bgp_table_ subtree_ lookup, bgp_dest_ has_bgp_ path_info_ data). The module builds with implicit- declaration warnings, and bgpd_rpki.so has unresolved symbols, so "bgpd -M rpki" fails to load the module and exits.
Impact ------ noble, jammy: route origin validation fails to open after any VRP change. A route that becomes RPKI Invalid stays installed and advertised despite an inbound "match rpki invalid" deny, until "clear bgp ... soft in" or a bgpd restart. Routes arriving after the change are still validated correctly.
focal (ESM Apps): bgpd configured with the rpki module (-M rpki) does not start, so BGP is unavailable on those systems.
Affected versions ----------------- noble: 8.4.4-1.1ubuntu6.3 up to and including 8.4.4-1.1ubuntu6.7 jammy: 8.1-1ubuntu1.12 up to and including 8.1-1ubuntu1.16 focal: 7.2.1-1ubuntu0. 2+esm3 up to and including 7.2.1-1ubuntu0. 2+esm4 (ESM Apps)
Steps to reproduce (noble, jammy) ------- ------- ------- ------- ----- 1. Configure bgpd with -M rpki, an RPKI cache, an eBGP neighbor with "soft- reconfiguration inbound" and an inbound route-map that denies "match rpki invalid". 2. Once routes are received, change the cache's VRP set so that an accepted route becomes Invalid. 3. "show rpki prefix-table" shows the new VRPs, but the route stays best and advertised. "show thread cpu" shows bgpd_sync_callback invoked once for the lifetime of the process. 4. "clear bgp soft in" corrects it.
Steps to reproduce (focal ESM Apps) ------- ------- ------- ------- ------- 1. Install frr and frr-rpki-rtrlib 7.2.1-1ubuntu0. 2+esm4. 2. Run: /usr/lib/frr/bgpd -M rpki -u frr -g frr -d -> 'loading module "rpki" failed: ...', exit status 1.
Fix --- noble, jammy: restore thread_ add_read( bm->master, bgpd_sync_callback, NULL, rpki_ sync_socket_ bgpd, NULL); as the first statement of bgpd_sync_ callback( ).
focal: port the revalidation code to the FRR 7.2.1 bgp_node API, and restore the same re-arm.
Related upstream ---------------- https:/ /github. com/FRRouting/ frr/issues/ 24001 reports a similar symptom on FRR 10.x with different causes (proposed fix: https:/ /github. com/FRRouting/ frr/pull/ 24131 , not merged). One of those causes is older than the CVE fix and exists in these releases too: a route the inbound policy denied, and which has no other path, is not re-accepted when it becomes Valid. Fixing this regression does not change that behaviour.
Reported by Andrew H. Bond.
Bug watches keep track of this bug in other bug trackers.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
