A vulnerability in IPv6 processing has been discovered that may allow a specially crafted IPv6 Neighbor Discovery (ND) packet to be accepted by the router rather than discarded. The crafted packet, destined to the router, will then be processed by the routing engine (RE). A malicious network-based packet flood, sourced from beyond the local broadcast domain, can cause the RE CPU to spike, or cause the DDoS protection ARP protocol group policer to engage. When this happens, the DDoS policer may start dropping legitimate IPv6 neighbors as legitimate ND times out. Note that this is similar to the router's response to any purposeful malicious IPv6 ND flood destined to the router. The difference is that the crafted packet identified in the vulnerability is such that the forwarding controllers/ASICs should disallow this traffic from reaching the RE for further processing. Additionally, due to the routable nature of the crafted IPv6 ND packet, the attack may be launched from beyond the local broadcast domain. This issue only affects systems with IPv6 enabled. The attack vector for the vulnerability relies on IPv6 Neighbor Discovery processing. If IPv6 is not enabled, then this issue is not applicable. This issue has been assigned CVE-2016-1409 .
Internal investigation has uncovered two separate issues with IPv6 Neighbor Discovery processing:
JUNOSe CQs 199315, 199316, and 119432 to address hotfixes and service releases for all E Series platforms and forwarding controllers (FC). Hotfixes are available for JUNOSe FC3 (LM10a, LM10U, LM10ADV) and FC2 (LM4) line cards. Contact JTAC to obtain the hotfixes for your specific software release and platform.
icmpv6-malformed
set security screen ids-option <screen name> icmp icmpv6-malformed
While no complete workaround currently exists for this issue, especially for adjacent network attacks from the local broadcast domain, security best current practices (BCPs) of filtering all ND traffic at the edge, destined to network infrastructure equipment, should be employed to limit the malicious attack surface of the vulnerability. Interface and/or control plane firewall filters may be used to stop propagation of NDP traffic beyond connected devices:
hop-limit
user@junos# show firewall family inet6 NDP filter NDP { term PERMIT_LOCAL_ICMP { from { next-header icmp6; hop-limit 255; } then { count PERMIT_LOCAL_ICMP; accept; } } term REJECT_NETWORK_ICMP { from { next-header icmp6; icmp-type [ neighbor-advertisement neighbor-solicit router-solicit router-advertisement redirect ]; } then { count REJECT_NETWORK_ICMP; discard; } } term PERMIT_ALL { then accept; } }
user@junos# show firewall family inet6 IPV6_PROTECT_RE filter IPV6_PROTECT_RE { term ICMPV6_TRUSTED { from { source-prefix-list { IPV6_TRUSTED_PREFIX_LIST; } next-header icmp6; } then accept; } term IPV6_ND_LOCAL { from { next-header icmp6; hop-limit 255; } then accept; } term ICMPV6 { from { next-header icmp6; icmp-type [ echo-request echo-reply time-exceeded destination-unreachable packet-too-big parameter-problem ]; } then accept; } term OTHER { then { count DROP; discard; } } }
user@junos# show firewall family inet6 NDP filter NDP { term PERMIT_VALID_ICMP { from { destination-address { fe80::/10; ff02::/123; ff02:0:0:0:0:1:ff00::/104; } } then { count PERMIT_VALID_ICMP; accept; } } term PERMIT_VALID_ICMP_LOCAL { from { source-address { x:x:x:x::/64; } destination-address { x:x:x:x::/64; } next-header icmp6; } then { count PERMIT_VALID_ICMP_LOCAL; accept; } } term REJECT_INVALID_ICMP { from { next-header icmp6; icmp-type [ neighbor-advertisement neighbor-solicit router-solicit router-advertisement redirect ]; } then { count REJECT_INVALID_ICMP; discard; } } }
user@junos# show firewall family inet6 IPV6_PROTECT_RE filter IPV6_PROTECT_RE { term ICMPV6_TRUSTED { from { source-prefix-list { IPV6_TRUSTED_PREFIX_LIST; } next-header icmp6; } then accept; } term IPV6_ND { from { destination-address { fe80::/10; ff02::/123; ff02:0:0:0:0:1:ff00::/104; } } then accept; } term IPV6_ND_LOCAL { from { source-address { x:x:x:x::/64; } destination-address { x:x:x:x::/64; } next-header icmp6; } then accept; } term ICMPV6 { from { next-header icmp6; icmp-type [ echo-request echo-reply time-exceeded destination-unreachable packet-too-big parameter-problem ]; } then accept; } term OTHER { then { count DROP; discard; } } }
2016-06-03: Initial publication 2016-06-06: Clarified impact of each issue. Highlighted difference between edge and control plane firewall filter. 2016-06-07: Minor tweaks to sample firewall filters. 2016-06-29: Added SRX screen mitigation. 2016-07-06: SRX not vulnerable with screen configured. PRs for other products pending on a confirmed fix for the issue. 2016-08-08: Confirmed through multi-vendor discussion and review of RFC4861 that forwarding non-compliant ND traffic is not, itself, in violation of the RFC. 2016-08-08: Hotfixes now available for JUNOSe. 2016-08-17: Minor clarification of JUNOSe CQs for hotfixes vs. service releases. 2016-09-07: Simplified list of Junos OS PRs and available fixes. 2016-10-05: More PRs for more Junos platforms. 2017-04-18: Full set of Junos OS fixed releases updated. 2017-06-26: Refreshed fixed releases for all platforms. 2018-08-13: Removed 14.2R8 references. 14.2R8 never shipped.