CVE-2021-0272 (GCVE-0-2021-0272)

Vulnerability from cvelistv5 – Published: 2021-04-22 19:37 – Updated: 2024-09-17 02:26
VLAI?
Title
Junos OS: QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016: In EVPN-VXLAN scenarios receipt of specific genuine packets by an adjacent attacker will cause a kernel memory leak in FPC.
Summary
A kernel memory leak in QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016 devices Flexible PIC Concentrators (FPCs) on Juniper Networks Junos OS allows an attacker to send genuine packets destined to the device to cause a Denial of Service (DoS) to the device. On QFX10002-32Q, QFX10002-60C, QFX10002-72Q devices the device will crash and restart. On QFX10008, QFX10016 devices, depending on the number of FPCs involved in an attack, one more more FPCs may crash and traffic through the device may be degraded in other ways, until the attack traffic stops. A reboot is required to restore service and clear the kernel memory. Continued receipt and processing of these genuine packets will create a sustained Denial of Service (DoS) condition. On QFX10008, QFX10016 devices, an indicator of compromise may be the existence of DCPFE core files. You can also monitor PFE memory utilization for incremental growth: user@qfx-RE:0% cprod -A fpc0 -c "show heap 0" | grep -i ke 0 3788a1b0 3221225048 2417120656 804104392 24 Kernel user@qfx-RE:0% cprod -A fpc0 -c "show heap 0" | grep -i ke 0 3788a1b0 3221225048 2332332200 888892848 27 Kernel This issue affects: Juniper Networks Junos OS on QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016: 16.1 versions 16.1R1 and above prior to 17.3 versions prior to 17.3R3-S9; 17.4 versions prior to 17.4R3-S2; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S5; 18.3 versions prior to 18.3R3-S3; 18.4 versions prior to 18.4R2-S5, 18.4R3-S4; 19.1 versions prior to 19.1R3-S2; 19.2 versions prior to 19.2R3; 19.3 versions prior to 19.3R3; 19.4 versions prior to 19.4R3; 20.1 versions prior to 20.1R2. This issue does not affect releases prior to Junos OS 16.1R1. This issue does not affect EX Series devices. This issue does not affect Junos OS Evolved.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-401 - Missing Release of Memory after Effective Lifetime
  • Denial of Service (DoS)
Assigner
References
Impacted products
Vendor Product Version
Juniper Networks Junos OS Unaffected: unspecified , < 16.1R1 (custom)
Affected: 17.3 , < 17.3R3-S9 (custom)
Affected: 17.4 , < 17.4R3-S2 (custom)
Affected: 18.1 , < 18.1R3-S11 (custom)
Affected: 18.2 , < 18.2R3-S5 (custom)
Affected: 18.3 , < 18.3R3-S3 (custom)
Affected: 18.4 , < 18.4R2-S5, 18.4R3-S4 (custom)
Affected: 19.1 , < 19.1R3-S2 (custom)
Affected: 19.2 , < 19.2R3 (custom)
Affected: 19.3 , < 19.3R3 (custom)
Affected: 19.4 , < 19.4R3 (custom)
Affected: 20.1 , < 20.1R2 (custom)
Affected: 16.1R1 , < 16.1* (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:32:10.543Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://kb.juniper.net/JSA11163"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://kb.juniper.net/KB32854"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016"
          ],
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "16.1R1",
              "status": "unaffected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "17.3R3-S9",
              "status": "affected",
              "version": "17.3",
              "versionType": "custom"
            },
            {
              "lessThan": "17.4R3-S2",
              "status": "affected",
              "version": "17.4",
              "versionType": "custom"
            },
            {
              "lessThan": "18.1R3-S11",
              "status": "affected",
              "version": "18.1",
              "versionType": "custom"
            },
            {
              "lessThan": "18.2R3-S5",
              "status": "affected",
              "version": "18.2",
              "versionType": "custom"
            },
            {
              "lessThan": "18.3R3-S3",
              "status": "affected",
              "version": "18.3",
              "versionType": "custom"
            },
            {
              "lessThan": "18.4R2-S5, 18.4R3-S4",
              "status": "affected",
              "version": "18.4",
              "versionType": "custom"
            },
            {
              "lessThan": "19.1R3-S2",
              "status": "affected",
              "version": "19.1",
              "versionType": "custom"
            },
            {
              "lessThan": "19.2R3",
              "status": "affected",
              "version": "19.2",
              "versionType": "custom"
            },
            {
              "lessThan": "19.3R3",
              "status": "affected",
              "version": "19.3",
              "versionType": "custom"
            },
            {
              "lessThan": "19.4R3",
              "status": "affected",
              "version": "19.4",
              "versionType": "custom"
            },
            {
              "lessThan": "20.1R2",
              "status": "affected",
              "version": "20.1",
              "versionType": "custom"
            },
            {
              "lessThan": "16.1*",
              "status": "affected",
              "version": "16.1R1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "This issue occurs in composite next hop EVPN-VXLAN scenarios, chained-composite-next-hop (CHN) being configured is not a requirement but can still affect EVPN pure type 5 with VXLAN encapsulation deployments.\n\nSee https://kb.juniper.net/KB32854 for further configuration details.\n\n\n  # configure access links:\n  [interfaces \u003c\u003e unit 0 family ethernet-switching interface-mode trunk]\n  [interfaces \u003c\u003e unit 0 family ethernet-switching vlan-members \u003c\u003e]\n  ...\n  # configure the core link\n  [interfaces \u003c\u003e unit 0 family inet address \u003c\u003e]\n \n  # configure loopback address\n  [interfaces lo0 unit 0 family inet address \u003c\u003e]\n \n  # configure IRB\n  [interfaces irb unit 1 family inet address \u003c\u003e]\n \n  # evpn\n  [protocols evpn encapsulation vxlan]\n  [protocols evpn extended-vni-list \u003c\u003e]\n  [routing-options router-id \u003c\u003e]\n  [routing-options autonomous-system 100]\n \n  [protocols bgp group pe type internal]\n  [protocols bgp group pe local-address \u003c\u003e]\n  [protocols bgp group pe family evpn signaling]\n  [protocols bgp group pe neighbor \u003c\u003e]\n \n  [protocols ospf area 0.0.0.0 interface lo0 passive]\n  [protocols ospf area 0.0.0.0 interface \u003c\u003e]\n \n  [switch-options route-distinguisher \u003c\u003e]\n  [switch-options vrf-target target:1:1]\n  [switch-options vtep-source-interface lo0.0]\n \n  [vlans \u003c\u003e vlan-id \u003c\u003e]\n  [vlans \u003c\u003e vxlan vni \u003c\u003e]\n  [vlans \u003c\u003e l3-interface irb.1]"
        }
      ],
      "datePublic": "2021-04-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A kernel memory leak in QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016 devices Flexible PIC Concentrators (FPCs) on Juniper Networks Junos OS allows an attacker to send genuine packets destined to the device to cause a Denial of Service (DoS) to the device. On QFX10002-32Q, QFX10002-60C, QFX10002-72Q devices the device will crash and restart. On QFX10008, QFX10016 devices, depending on the number of FPCs involved in an attack, one more more FPCs may crash and traffic through the device may be degraded in other ways, until the attack traffic stops. A reboot is required to restore service and clear the kernel memory. Continued receipt and processing of these genuine packets will create a sustained Denial of Service (DoS) condition. On QFX10008, QFX10016 devices, an indicator of compromise may be the existence of DCPFE core files. You can also monitor PFE memory utilization for incremental growth: user@qfx-RE:0% cprod -A fpc0 -c \"show heap 0\" | grep -i ke 0 3788a1b0 3221225048 2417120656 804104392 24 Kernel user@qfx-RE:0% cprod -A fpc0 -c \"show heap 0\" | grep -i ke 0 3788a1b0 3221225048 2332332200 888892848 27 Kernel This issue affects: Juniper Networks Junos OS on QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016: 16.1 versions 16.1R1 and above prior to 17.3 versions prior to 17.3R3-S9; 17.4 versions prior to 17.4R3-S2; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S5; 18.3 versions prior to 18.3R3-S3; 18.4 versions prior to 18.4R2-S5, 18.4R3-S4; 19.1 versions prior to 19.1R3-S2; 19.2 versions prior to 19.2R3; 19.3 versions prior to 19.3R3; 19.4 versions prior to 19.4R3; 20.1 versions prior to 20.1R2. This issue does not affect releases prior to Junos OS 16.1R1. This issue does not affect EX Series devices. This issue does not affect Junos OS Evolved."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401 Missing Release of Memory after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "Denial of Service (DoS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-22T19:37:27.000Z",
        "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "shortName": "juniper"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://kb.juniper.net/JSA11163"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://kb.juniper.net/KB32854"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The following software releases have been updated to resolve this specific issue: 17.3R3-S9, 17.4R3-S2, 18.1R3-S11, 18.2R3-S5, 18.3R3-S3, 18.4R2-S5, 18.4R3-S4, 19.1R3-S2, 19.2R3, 19.3R3, 19.4R3, 20.1R2, 20.2R1, and all subsequent releases."
        }
      ],
      "source": {
        "advisory": "JSA11163",
        "defect": [
          "1486614"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Junos OS: QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016: In EVPN-VXLAN scenarios receipt of specific genuine packets by an adjacent attacker will cause a kernel memory leak in FPC.",
      "workarounds": [
        {
          "lang": "en",
          "value": "There are no known workarounds for this issue."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "sirt@juniper.net",
          "DATE_PUBLIC": "2021-04-14T16:00:00.000Z",
          "ID": "CVE-2021-0272",
          "STATE": "PUBLIC",
          "TITLE": "Junos OS: QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016: In EVPN-VXLAN scenarios receipt of specific genuine packets by an adjacent attacker will cause a kernel memory leak in FPC."
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Junos OS",
                      "version": {
                        "version_data": [
                          {
                            "platform": "QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016",
                            "version_affected": "\u003c",
                            "version_name": "17.3",
                            "version_value": "17.3R3-S9"
                          },
                          {
                            "platform": "QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016",
                            "version_affected": "\u003c",
                            "version_name": "17.4",
                            "version_value": "17.4R3-S2"
                          },
                          {
                            "platform": "QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016",
                            "version_affected": "\u003c",
                            "version_name": "18.1",
                            "version_value": "18.1R3-S11"
                          },
                          {
                            "platform": "QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016",
                            "version_affected": "\u003c",
                            "version_name": "18.2",
                            "version_value": "18.2R3-S5"
                          },
                          {
                            "platform": "QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016",
                            "version_affected": "\u003c",
                            "version_name": "18.3",
                            "version_value": "18.3R3-S3"
                          },
                          {
                            "platform": "QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016",
                            "version_affected": "\u003c",
                            "version_name": "18.4",
                            "version_value": "18.4R2-S5, 18.4R3-S4"
                          },
                          {
                            "platform": "QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016",
                            "version_affected": "\u003c",
                            "version_name": "19.1",
                            "version_value": "19.1R3-S2"
                          },
                          {
                            "platform": "QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016",
                            "version_affected": "\u003c",
                            "version_name": "19.2",
                            "version_value": "19.2R3"
                          },
                          {
                            "platform": "QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016",
                            "version_affected": "\u003c",
                            "version_name": "19.3",
                            "version_value": "19.3R3"
                          },
                          {
                            "platform": "QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016",
                            "version_affected": "\u003c",
                            "version_name": "19.4",
                            "version_value": "19.4R3"
                          },
                          {
                            "platform": "QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016",
                            "version_affected": "\u003c",
                            "version_name": "20.1",
                            "version_value": "20.1R2"
                          },
                          {
                            "platform": "QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016",
                            "version_affected": "\u003e=",
                            "version_name": "16.1",
                            "version_value": "16.1R1"
                          },
                          {
                            "platform": "QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016",
                            "version_affected": "!\u003c",
                            "version_value": "16.1R1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Juniper Networks"
              }
            ]
          }
        },
        "configuration": [
          {
            "lang": "en",
            "value": "This issue occurs in composite next hop EVPN-VXLAN scenarios, chained-composite-next-hop (CHN) being configured is not a requirement but can still affect EVPN pure type 5 with VXLAN encapsulation deployments.\n\nSee https://kb.juniper.net/KB32854 for further configuration details.\n\n\n  # configure access links:\n  [interfaces \u003c\u003e unit 0 family ethernet-switching interface-mode trunk]\n  [interfaces \u003c\u003e unit 0 family ethernet-switching vlan-members \u003c\u003e]\n  ...\n  # configure the core link\n  [interfaces \u003c\u003e unit 0 family inet address \u003c\u003e]\n \n  # configure loopback address\n  [interfaces lo0 unit 0 family inet address \u003c\u003e]\n \n  # configure IRB\n  [interfaces irb unit 1 family inet address \u003c\u003e]\n \n  # evpn\n  [protocols evpn encapsulation vxlan]\n  [protocols evpn extended-vni-list \u003c\u003e]\n  [routing-options router-id \u003c\u003e]\n  [routing-options autonomous-system 100]\n \n  [protocols bgp group pe type internal]\n  [protocols bgp group pe local-address \u003c\u003e]\n  [protocols bgp group pe family evpn signaling]\n  [protocols bgp group pe neighbor \u003c\u003e]\n \n  [protocols ospf area 0.0.0.0 interface lo0 passive]\n  [protocols ospf area 0.0.0.0 interface \u003c\u003e]\n \n  [switch-options route-distinguisher \u003c\u003e]\n  [switch-options vrf-target target:1:1]\n  [switch-options vtep-source-interface lo0.0]\n \n  [vlans \u003c\u003e vlan-id \u003c\u003e]\n  [vlans \u003c\u003e vxlan vni \u003c\u003e]\n  [vlans \u003c\u003e l3-interface irb.1]"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A kernel memory leak in QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016 devices Flexible PIC Concentrators (FPCs) on Juniper Networks Junos OS allows an attacker to send genuine packets destined to the device to cause a Denial of Service (DoS) to the device. On QFX10002-32Q, QFX10002-60C, QFX10002-72Q devices the device will crash and restart. On QFX10008, QFX10016 devices, depending on the number of FPCs involved in an attack, one more more FPCs may crash and traffic through the device may be degraded in other ways, until the attack traffic stops. A reboot is required to restore service and clear the kernel memory. Continued receipt and processing of these genuine packets will create a sustained Denial of Service (DoS) condition. On QFX10008, QFX10016 devices, an indicator of compromise may be the existence of DCPFE core files. You can also monitor PFE memory utilization for incremental growth: user@qfx-RE:0% cprod -A fpc0 -c \"show heap 0\" | grep -i ke 0 3788a1b0 3221225048 2417120656 804104392 24 Kernel user@qfx-RE:0% cprod -A fpc0 -c \"show heap 0\" | grep -i ke 0 3788a1b0 3221225048 2332332200 888892848 27 Kernel This issue affects: Juniper Networks Junos OS on QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016: 16.1 versions 16.1R1 and above prior to 17.3 versions prior to 17.3R3-S9; 17.4 versions prior to 17.4R3-S2; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S5; 18.3 versions prior to 18.3R3-S3; 18.4 versions prior to 18.4R2-S5, 18.4R3-S4; 19.1 versions prior to 19.1R3-S2; 19.2 versions prior to 19.2R3; 19.3 versions prior to 19.3R3; 19.4 versions prior to 19.4R3; 20.1 versions prior to 20.1R2. This issue does not affect releases prior to Junos OS 16.1R1. This issue does not affect EX Series devices. This issue does not affect Junos OS Evolved."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
          }
        ],
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-401 Missing Release of Memory after Effective Lifetime"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service (DoS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://kb.juniper.net/JSA11163",
              "refsource": "MISC",
              "url": "https://kb.juniper.net/JSA11163"
            },
            {
              "name": "https://kb.juniper.net/KB32854",
              "refsource": "MISC",
              "url": "https://kb.juniper.net/KB32854"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "The following software releases have been updated to resolve this specific issue: 17.3R3-S9, 17.4R3-S2, 18.1R3-S11, 18.2R3-S5, 18.3R3-S3, 18.4R2-S5, 18.4R3-S4, 19.1R3-S2, 19.2R3, 19.3R3, 19.4R3, 20.1R2, 20.2R1, and all subsequent releases."
          }
        ],
        "source": {
          "advisory": "JSA11163",
          "defect": [
            "1486614"
          ],
          "discovery": "INTERNAL"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "There are no known workarounds for this issue."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
    "assignerShortName": "juniper",
    "cveId": "CVE-2021-0272",
    "datePublished": "2021-04-22T19:37:27.674Z",
    "dateReserved": "2020-10-27T00:00:00.000Z",
    "dateUpdated": "2024-09-17T02:26:24.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.