CVE-2022-42917: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-42917 is a local privilege escalation vulnerability in FRRouting (FRR) caused by a Time-of-Check Time-of-Use (TOCTOU) race condition in configuration file handling. The FRR service user (typically frr) can escalate privileges to root by monitoring /etc/frr and replacing newly created config files with symlinks before ownership is changed via chown. All FRR versions before 8.5 are affected. It carries a CVSS v3.1 base score of 6.7 (Medium) (Github Advisory, bugzilla.redhat.com).

The root cause is a TOCTOU race condition (CWE-367) in FRR's startup scripts (tools/frr.in and tools/frrcommon.sh.in), where config files are first created with touch and then ownership is changed with a separate chownfrr function. The window between these two operations allows the frr service user — which has write access to /etc/frr — to replace the newly created file with a symlink pointing to an arbitrary system file (e.g., /etc/passwd or /etc/sudoers), causing the subsequent chown to transfer ownership of that target file to the frr user. Exploitation requires low privileges (the frr service account), local access, and a timing-sensitive race, making it moderately complex. The fix replaces the touch/chown sequence with the atomic install command, which creates the file and sets ownership/permissions in a single operation (FRR Commit, Github Advisory).

Successful exploitation allows the frr service user to gain full root-level control of the host system by changing ownership of arbitrary files. This can lead to complete compromise of confidentiality, integrity, and availability — an attacker could modify sensitive system files (e.g., /etc/sudoers, /etc/passwd), read protected data, or disrupt system services. The scope is limited to the local system, but root access enables lateral movement within the environment and persistent backdoor installation (Github Advisory, bugzilla.redhat.com).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of reporting (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.131% (3rd percentile), indicating a low probability of near-term exploitation. Exploitation requires local access as the frr service user and precise timing to win the race condition, which limits its practical exploitability.

1. Gain access as the frr service user: Obtain a shell or code execution as the low-privileged frr service account on a system running FRR before version 8.5.
2. Monitor the configuration directory: Continuously watch /etc/frr for new file creation events, using tools such as inotifywait (from the inotify-tools package): inotifywait -m /etc/frr -e create.
3. Race the file creation: When FRR's startup script executes touch /etc/frr/<daemon>.conf, immediately replace the newly created file with a symlink pointing to a target system file whose ownership you wish to change: ln -sf /etc/sudoers /etc/frr/<daemon>.conf.
4. Trigger the chown operation: Allow the FRR startup script to proceed to the chownfrr function, which calls chown frr /etc/frr/<daemon>.conf. Because the file is now a symlink, chown follows it and transfers ownership of the target file (e.g., /etc/sudoers) to the frr user.
5. Modify the target file: With ownership of the target file, write a privilege escalation payload (e.g., add frr ALL=(ALL) NOPASSWD: ALL to /etc/sudoers).
6. Escalate to root: Execute sudo su or sudo bash as the frr user to obtain a root shell (FRR Commit, Github Advisory).

• File System: Unexpected symlinks in /etc/frr/ pointing to system files (e.g., /etc/sudoers, /etc/passwd); ownership changes on sensitive system files to the frr user; unexpected modifications to /etc/sudoers or /etc/passwd.
• Logs: auditd records showing chown or chownfrr operations on files outside /etc/frr; inotify-related activity on /etc/frr from the frr user process; sudo usage by the frr account in /var/log/auth.log or /var/log/secure.
• Process: Unexpected shell processes (e.g., bash, sh) spawned by or as the frr user; inotifywait or similar file-watching utilities running under the frr account.

Upgrade FRRouting to version 8.5 or later, which replaces the vulnerable touch/chown sequence with the atomic install command, eliminating the race condition window (FRR Commit). As a workaround, restrict the frr service user's ability to write to /etc/frr beyond what is strictly necessary, and apply strict directory permissions and nosymfollow mount options where supported to prevent symlink-based attacks. Enabling file integrity monitoring (e.g., AIDE, Tripwire) on /etc/frr and sensitive system files can help detect unauthorized changes.

The vulnerability was tracked by SUSE via their Bugzilla instance and by Red Hat's Product Security team, both of whom filed tracking bugs. The FRR project addressed the issue promptly with a targeted commit replacing the unsafe touch/chown pattern. No significant broader media coverage or notable researcher commentary beyond standard advisory channels has been identified (bugzilla.redhat.com).