CVE-2017-3224 | Open Shortest Path First (OSPF) protocol implementations may improperly determine LSA recency in affected Quagga and downstream implementations (SUSE, openSUSE, and Red Hat packages)

Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement (LSA) recency for LSAs with MaxSequenceNumber. According to RFC 2328 section 13.1, for two instances of the same LSA, recency is determined by first comparing sequence numbers, then checksums, and finally MaxAge. In a case where the sequence numbers are the same, the LSA with the larger checksum is considered more recent, and will not be flushed from the Link State Database (LSDB). Since the RFC does not explicitly state that the values of links carried by a LSA must be the same when prematurely aging a self-originating LSA with MaxSequenceNumber, it is possible in vulnerable OSPF implementations for an attacker to craft a LSA with MaxSequenceNumber and invalid links that will result in a larger checksum and thus a 'newer' LSA that will not be flushed from the LSDB. Propagation of the crafted LSA can result in the erasure or alteration of the routing tables of routers within the routing domain, creating a denial of service condition or the re-routing of traffic on the network. CVE-2017-3224 has been reserved for Quagga and downstream implementations (SUSE, openSUSE, and Red Hat packages).

Published: 2018-07-24 Last update: 2024-11-21 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2017-3224 is rated Low Risk (34.2/100): CVSS High severity, with low exploitation likelihood (EPSS 0.03%). Monitor for updates and reassess as exploit intelligence or EPSS changes.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2017-3224

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-03-17 0.07% 0.03% -0.05%
2 2023-03-07 0.89% 0.07% -0.81%
3 2022-02-04 — 0.89% —

Full EPSS history (4 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2017-3224

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
8.2 3.0 HIGH
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H Click to expand
Attack vector (AV:A)
Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 1.6 6.0 [email protected]
4.3 2.0 MEDIUM
AV:A/AC:M/Au:N/C:N/I:P/A:P Click to expand
Access vector (AV:A)
Requires access to an adjacent network segment.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:P)
Partial availability impact.
 5.5 4.9 [email protected]

Weakness enumeration for CVE-2017-3224

OS Trackers for CVE-2017-3224

vendor priority summary link
debian unimportant CVE-2017-3224 unimportant priority: Debian including 1 source packages (frr), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2017-3224
redhat medium — https://access.redhat.com/security/cve/CVE-2017-3224
ubuntu low CVE-2017-3224 low priority: Ubuntu including 1 source packages (quagga), 21 status rows across 21 suites (artful, bionic, cosmic, disco, eoan, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial, zesty): DNE 9, ignored 8, needed 4. https://ubuntu.com/security/CVE-2017-3224

Affected software / configurations for CVE-2017-3224

Vendor Product Version Raw CPE
quagga quagga — cpe:2.3:a:quagga:quagga:-:*:*:*:*:*:*:*
suse opensuse — cpe:2.3:o:suse:opensuse:-:*:*:*:*:*:*:*
suse suse_linux — cpe:2.3:o:suse:suse_linux:-:*:*:*:*:*:*:*
redhat package_manager — cpe:2.3:a:redhat:package_manager:-:*:*:*:*:*:*:*

References for CVE-2017-3224

URL Tags
https://www.kb.cert.org/vuls/id/793496 Third Party Advisory US Government Resource
cvelogic Threat Intelligence