On PTX Series and QFX10k Series devices with the "inline-jflow" feature enabled, a use after free weakness in the Packet Forwarding Engine (PFE) microkernel architecture of Juniper Networks Junos OS may allow an attacker to cause a Denial of Service (DoS) condition whereby one or more Flexible PIC Concentrators (FPCs) may restart. As this is a race condition situation this issue become more likely to be hit when network instability occurs, such as but not limited to BGP/IGP reconvergences, and/or further likely to occur when more active "traffic flows" are occurring through the device. When this issue occurs, it will cause one or more FPCs to restart unexpectedly. During FPC restarts core files will be generated. While the core file is generated traffic will be disrupted. Sustained receipt of large traffic flows and reconvergence-like situations may sustain the Denial of Service (DoS) situation.
This issue affects:
Juniper Networks Junos OS:
The inline flow monitoring configuration can be broadly classified into the following categories:
Configurations at the [edit services flow-monitoring version-ipfix template] or [edit services flow-monitoring version9 template] hierarchy level—At this level, you configure the template properties for inline flow monitoring.
Configurations at the [edit forwarding-options sampling instance] hierarchy level—At this level, you configure a sampling instance and associate the template to the sampling instance. At this level, you also configure the flow-server IP address and port number as well as the autonomous system type.
Configurations at the [edit chassis fpc] hierarchy level—At this level, you associate the sampling instance with the FPC on which the media interface is present.
Configurations at the [edit firewall] hierarchy level—At this level you configure a firewall filter for the family of traffic to be sampled. You must attach this filter to the interface on which you want to sample the traffic.
See https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/inline-flow-monitoring-ptx.html for further details.
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
This issue was seen during production usage.
This issue has been assigned CVE-2021-0270 .
The following software releases have been updated to resolve this specific issue: 16.1R7-S8, 17.2R3-S4, 17.3R3-S8, 17.4R2-S11, 17.4R3-S2, 18.1R3-S10, 18.2R1, and all subsequent releases.
This issue is being tracked as 1498427 .
Software releases or updates are available for download at https://support.juniper.net/support/downloads/
If you are susceptible to this issue and unable to upgrade to software with the fix, you can deploy a workaround by disabling the “inline-flow” feature.
To check for use and to disable the “inline-jflow” service on a device, see https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/inline-flow-monitoring-ptx.html for additional details.
Removing “inline-jflow” takes effect immediately and there is no need to restart the FPCs or the router. Once the feature is removed, the router no longer provides traffic data to the flow collector.
2021-04-14: Initial Publication. 2021-04-14: Added QFX after PTX on FPC.