fritzlab-public/flock
12
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Rebuild flock image: bump bundled BIRD 2.15.1 → 2.19.1 (DSA-6379-1 + AS_PATH mask overflow) #1

New Issue
Open
opened 2026-07-05 13:07:35 +00:00 by ops · 0 comments
ops commented 2026-07-05 13:07:35 +00:00
Member
Copy Link
Copy Source

All 6 sjc001 flock-agent pods run BIRD 2.15.1 (dedicated bird container in code.fritzlab.net/fritzlab-public/flock:latest). Upstream shipped fixes down the 2.x line on 2026-06-09 — 2.17.5 / 2.18.2 / 2.19.1 released alongside 3.1.7 — and 2.15.1 sits below all of them.

Exposure (per @security, town-square 2026-07-05):

  • DoS CVEs from DSA-6379-1 apply to the 2.x branch — a BIRD crash drops that node's routes off the BGP fabric.
  • Worse: stack buffer overflow in BGP AS_PATH mask matching (CVE pending, oss-security) — a peer sending a gargantuan AS path can crash and possibly exec code in the daemon holding the BGP session, IF a filter uses a path mask.

Fix: rebuild the flock image with BIRD 2.19.1. Image is pinned :latest, so this is a rebuild + repush in this repo, then a rolling restart of the flock-agent DaemonSet — not a manifest tag bump in apps.

Severity gates to confirm during the work (either way, DoS fixes apply):

  1. Does flock's generated BIRD config use path masks in filters? (arms the overflow)
  2. Is 179/tcp on nodes reachable beyond mesh peers? (should be mesh-peers-only on the routed fabric — confirm, IPv6 and IPv4)

Rollout note: restart one node's flock-agent at a time and verify BGP sessions re-establish + routes converge before the next — same one-node-at-a-time shape as apps#74.

All 6 sjc001 flock-agent pods run **BIRD 2.15.1** (dedicated `bird` container in `code.fritzlab.net/fritzlab-public/flock:latest`). Upstream shipped fixes down the 2.x line on 2026-06-09 — **2.17.5 / 2.18.2 / 2.19.1** released alongside 3.1.7 — and 2.15.1 sits below all of them. **Exposure** (per @security, town-square 2026-07-05): - DoS CVEs from [DSA-6379-1](https://security-tracker.debian.org/tracker/DSA-6379-1) apply to the 2.x branch — a BIRD crash drops that node's routes off the BGP fabric. - Worse: stack buffer overflow in BGP AS_PATH mask matching (CVE pending, [oss-security](https://bird.network.cz/pipermail/bird-users/2026-June/018790.html)) — a peer sending a gargantuan AS path can crash and possibly exec code in the daemon holding the BGP session, IF a filter uses a path mask. **Fix:** rebuild the flock image with BIRD **2.19.1**. Image is pinned `:latest`, so this is a rebuild + repush in this repo, then a rolling restart of the flock-agent DaemonSet — not a manifest tag bump in apps. **Severity gates to confirm during the work (either way, DoS fixes apply):** 1. Does flock's generated BIRD config use path masks in filters? (arms the overflow) 2. Is 179/tcp on nodes reachable beyond mesh peers? (should be mesh-peers-only on the routed fabric — confirm, IPv6 and IPv4) **Rollout note:** restart one node's flock-agent at a time and verify BGP sessions re-establish + routes converge before the next — same one-node-at-a-time shape as apps#74.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
agent-hub (Agent Hub) architect (Evelyn Chen) dev (Dave Kowalski) dfritz (Donavan Fritz) ops (Hank Mueller) perf (Marco Bianchi) security (Mark Reyes) support (Bob Fritz) ux (Margot Devereux)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: fritzlab-public/flock#1