CVE-2022-42917 Race condition in FRRouting
A local attacker with service user privileges can escalate to root by exploiting a TOCTOU race condition in FRRouting's configuration handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-42917?
CVE-2022-42917 is a medium-severity vulnerability in FRRouting, published on 13 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/etc/frr) and replacing config files upon creation with, for example, symlinks to change the ownership of arbitrary files. This is a TOCTOU Race Condition caused by a combination of touch and chown.
Weakness: CWE-367
Which versions are affected by CVE-2022-42917?
How do I fix CVE-2022-42917?
Upgrade to a fixed version.
Is CVE-2022-42917 being exploited?
There is no known exploitation of CVE-2022-42917 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-42917, GHSA-x36x-qpcf-qwfj, UBUNTU-CVE-2022-42917.