An Improper Input Validation vulnerability in the kernel of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS).

If the receipt of router advertisements is enabled on an interface and a specifically malformed RA packet is received, memory corruption will happen which leads to an rpd crash.

This issue affects:

Juniper Networks Junos OS

20.3 versions prior to 20.3R3-S5;

20.4 versions prior to 20.4R3-S3;

21.1 versions prior to 21.1R3-S4;

21.2 versions prior to 21.2R3;

21.3 versions prior to 21.3R3;

21.4 versions prior to 21.4R2;

22.1 versions prior to 22.1R2.

Juniper Networks Junos OS Evolved

20.3-EVO version 20.3R1-EVO and later versions;

20.4-EVO versions prior to 20.4R3-S6-EVO;

21.3-EVO versions prior to 21.3R3-EVO;

21.4-EVO versions prior to 21.4R2-EVO;

22.1-EVO versions prior to 22.1R2-EVO.

To be affected by this vulnerability router advertisements need to be enabled on the interface:

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was seen during production usage.

This issue has been assigned CVE-2023-28981.

The following software releases have been updated to resolve this specific issue:

Junos OS Evolved: 20.4R3-S6-EVO, 21.3R3-EVO, 21.4R2-EVO, 22.1R2-EVO, 22.2R1-EVO, and all subsequent releases.

Junos OS: 20.3R3-S5, 20.4R3-S3, 21.1R3-S4, 21.2R3, 21.3R3, 21.4R2, 22.1R2, 22.2R1, and all subsequent releases.

This issue is being tracked as 1645928

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

If the receipt of router advertisements is not necessary (but just the solicited or unsolicited sending of RAs) then incoming RAs can be filtered and dropped by applying a firewall filter like the following:

set firewall family inet6 filter test term 1 from next-header icmp6

set firewall family inet6 filter test term 1 from icmp-type 134

set firewall family inet6 filter test term 1 then discard

set firewall family inet6 filter test term 2 then accept

• 2023-04-12: Initial Publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2023-28981 at cve.mitre.org