Description

In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/etc/frr) and replacing config files upon creation with, for example, symlinks to change the ownership of arbitrary files. This is a TOCTOU Race Condition caused by a combination of touch and chown.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.7",
  "pubDate": "2026-09-14T00:16:55.700Z",
  "pubdate": "2026-09-14T00:16:55.700Z",
  "executiveSummary": "This vulnerability in FRRouting (FRR) versions prior to 8.5 involves a Time-of-Check to Time-of-Use (TOCTOU) race condition that allows a local low-privileged user (specifically the service user 'frr') to escalate privileges to root.\nThe vulnerability manifests within the management of the configuration directory (/etc/frr). By exploiting the insecure sequence of file system operations involving 'touch' and 'chown', an attacker can manipulate file ownership, leading to unauthorized arbitrary file access or modification.\nThe risk implication is significant as it permits lateral movement from the restricted service account to the root security context, effectively compromising the integrity and security of the entire host system.\nSuccessful exploitation requires the attacker to have initial access as the 'frr' user and the ability to monitor and influence file system events within the configuration directory during service operation.",
  "technicalDetails": "The vulnerability resides in how FRRouting handles the initialization and management of its configuration files within /etc/frr. The root cause is a race condition inherent in the program's logic during the transition between verifying the presence of configuration files and applying ownership permissions.\nThe exploitation process leverages the gap between the 'touch' operation, which initializes or creates the config file, and the subsequent 'chown' operation, which adjusts file ownership. Because these operations are not executed atomically, there is an exploitable window between the check and the use of the file path.\nAn attacker with access to the 'frr' service user account monitors the /etc/frr directory for creation events. When the service triggers a creation event, the attacker replaces the legitimate configuration file with a symbolic link pointing to a critical system file (e.g., /etc/shadow or /etc/sudoers).\nWhen the 'chown' process executes, it follows the attacker-supplied symlink instead of operating on the intended configuration file. Consequently, the ownership of the target system file is modified to be owned by the 'frr' user. By gaining ownership over security-sensitive files, the attacker can then modify them to grant themselves full root access or inject malicious payloads to execute arbitrary code with elevated privileges.\nThis behavior confirms that the application lacks adequate protections against symlink attacks during directory management and fails to utilize secure file descriptors or atomic primitives (such as fchown) that operate on open files rather than paths. This issue affects all FRRouting versions prior to 8.5."
}