CVE-2024-21600
Assigner: juniper
Published: 2024-01-12T00:53:38.834Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: PTX1000
PTX3000
PTX5000 with FPC3
PTX10002-60C
PTX10008/16 with LC110x
product: Junos OS
vendor: Juniper Networks
versions: lessThan: 20.4R3-S8
status: affected
version: 0
versionType: semver
lessThan: 21.1R3-S4
status: affected
version: 21.1
versionType: semver
lessThan: 21.2R3-S6
status: affected
version: 21.2
versionType: semver
lessThan: 21.3R3-S3
status: affected
version: 21.3
versionType: semver
lessThan: 21.4R3-S5
status: affected
version: 21.4
versionType: semver
lessThan: 22.1R2-S2, 22.1R3
status: affected
version: 22.1
versionType: semver
lessThan: 22.2R2-S1, 22.2R3
status: affected
version: 22.2
versionType: semver
configurations: supportingMedia: base64: no
type: text/html
value: <p>To be exposed to this issue FTI need to be configured:</p><code>  [ interfaces fti0 unit &lt;unit&gt; tunnel ... ]</code><br/>
value: To be exposed to this issue FTI need to be configured:

  [ interfaces fti0 unit <unit> tunnel ... ]

datePublic: 2024-01-10T17:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 

<p>An Improper Neutralization of Equivalent Special Elements vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on PTX Series allows a unauthenticated, adjacent attacker to cause a Denial of Service (DoS).</p><p>When MPLS packets are meant to be sent to a flexible tunnel interface (FTI) and if the FTI tunnel is down, these will hit the reject NH, due to which the packets get sent to the CPU and cause a host path wedge condition. This will cause the FPC to hang and requires a manual restart to recover.</p><p>Please note that this issue specifically affects PTX1000, PTX3000, PTX5000 with FPC3, PTX10002-60C, and PTX10008/16 with LC110x. Other PTX Series devices and Line Cards (LC) are not affected.</p><p>The following log message can be seen when the issue occurs:</p><code>Cmerror Op Set: Host Loopback: HOST LOOPBACK WEDGE DETECTED IN PATH ID &lt;id&gt; (URI: /fpc/&lt;fpc&gt;/pfe/&lt;pfe&gt;/cm/&lt;cm&gt;/Host_Loopback/&lt;cm&gt;/HOST_LOOPBACK_MAKE_CMERROR_ID[&lt;id&gt;])</code><br><p>This issue affects Juniper Networks Junos OS:</p><p></p><ul><li>All versions earlier than 20.4R3-S8;</li><li>21.1 versions earlier than 21.1R3-S4;</li><li>21.2 versions earlier than 21.2R3-S6;</li><li>21.3 versions earlier than 21.3R3-S3;</li><li>21.4 versions earlier than 21.4R3-S5;</li><li>22.1 versions earlier than 22.1R2-S2, 22.1R3;</li><li>22.2 versions earlier than 22.2R2-S1, 22.2R3.</li></ul><p></p>


value: 
An Improper Neutralization of Equivalent Special Elements vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on PTX Series allows a unauthenticated, adjacent attacker to cause a Denial of Service (DoS).

When MPLS packets are meant to be sent to a flexible tunnel interface (FTI) and if the FTI tunnel is down, these will hit the reject NH, due to which the packets get sent to the CPU and cause a host path wedge condition. This will cause the FPC to hang and requires a manual restart to recover.

Please note that this issue specifically affects PTX1000, PTX3000, PTX5000 with FPC3, PTX10002-60C, and PTX10008/16 with LC110x. Other PTX Series devices and Line Cards (LC) are not affected.

The following log message can be seen when the issue occurs:

Cmerror Op Set: Host Loopback: HOST LOOPBACK WEDGE DETECTED IN PATH ID <id> (URI: /fpc/<fpc>/pfe/<pfe>/cm/<cm>/Host_Loopback/<cm>/HOST_LOOPBACK_MAKE_CMERROR_ID[<id>])
This issue affects Juniper Networks Junos OS:



  *  All versions earlier than 20.4R3-S8;
  *  21.1 versions earlier than 21.1R3-S4;
  *  21.2 versions earlier than 21.2R3-S6;
  *  21.3 versions earlier than 21.3R3-S3;
  *  21.4 versions earlier than 21.4R3-S5;
  *  22.1 versions earlier than 22.1R2-S2, 22.1R3;
  *  22.2 versions earlier than 22.2R2-S1, 22.2R3.







exploits: supportingMedia: base64: no
type: text/html
value: <p>Juniper SIRT is not aware of any malicious exploitation of this vulnerability.</p>
value: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-76
description: CWE-76 Improper Neutralization of Equivalent Special Elements
type: CWE
descriptions: description: Denial of Service (DoS)
solutions: supportingMedia: base64: no
type: text/html
value: <p>The following software releases have been updated to resolve this specific issue: Junos OS 20.4R3-S8, 21.1R3-S4, 21.2R3-S6, 21.3R3-S3, 21.4R3-S5, 22.1R2-S2, 22.1R3, 22.2R2-S1, 22.2R3, 22.3R1, and all subsequent releases.</p>
value: The following software releases have been updated to resolve this specific issue: Junos OS 20.4R3-S8, 21.1R3-S4, 21.2R3-S6, 21.3R3-S3, 21.4R3-S5, 22.1R2-S2, 22.1R3, 22.2R2-S1, 22.2R3, 22.3R1, and all subsequent releases.


source: advisory: JSA75741
defect: 1653316
discovery: USER
timeline: time: 2024-01-10T17:00:00.000Z
value: Initial Publication
title: Junos OS: PTX Series: In an FTI scenario MPLS packets hitting reject next-hop will cause a host path wedge condition
workarounds: supportingMedia: base64: no
type: text/html
value: <p>The issue can be prevented by configuring a limit for reject packets via:</p><code>  [ system ddos-protection protocols reject aggregate bandwidth 20 ] </code><br/>
value: The issue can be prevented by configuring a limit for reject packets via:

  [ system ddos-protection protocols reject aggregate bandwidth 20 ] 

x_generator: engine: Vulnogram 0.1.0-av217