CVE-2022-42917
Received Received - Intake

Privilege Escalation via TOCTOU Race Condition in FRRouting FRR

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: MITRE

Description
In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/etc/frr) and replacing config files upon creation with, for example, symlinks to change the ownership of arbitrary files. This is a TOCTOU Race Condition caused by a combination of touch and chown.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2022-42917
EUVD
EUVD-2022-56059

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frrouting frr to 8.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2022-42917 is a TOCTOU (Time-of-Check to Time-of-Use) race condition vulnerability in FRRouting FRR before version 8.5. It occurs when the service user (typically frr) monitors the configuration directory (/etc/frr) and replaces newly created config files with symlinks. This allows the user to manipulate file ownership, potentially escalating privileges to root by exploiting the combination of touch and chown commands.

Detection Guidance

Detecting this vulnerability requires monitoring for suspicious file ownership changes in /etc/frr. Check for unexpected root-owned files or symlinks in the configuration directory. Commands like 'ls -la /etc/frr' or 'find /etc/frr -user root -type f' may help identify anomalies.

Impact Analysis

This vulnerability allows a local attacker with access to the frr service account to gain root privileges. By exploiting the race condition, they can modify file ownership of critical system files, leading to full system compromise. The impact includes unauthorized access, data manipulation, and potential denial of service.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data integrity, such as GDPR's security principles or HIPAA's safeguards for protected health information. Unauthorized privilege escalation risks data breaches and non-compliance with regulatory controls for confidentiality and integrity.

Mitigation Strategies

Upgrade FRRouting FRR to version 8.5 or later to apply the fix. If upgrading is not immediately possible, restrict write access to /etc/frr and monitor for unauthorized changes. Remove the frr user's ability to modify critical files until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2022-42917. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart