An Improper Handling of Syntactically Invalid Structure vulnerability in Object Flooding Protocol (OFP) service of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).
On all Junos OS Evolved platforms, when specific TCP packets are received on an open OFP port, the OFP crashes leading to a restart of Routine Engine (RE). Continuous receipt of these specific TCP packets will lead to a sustained Denial of Service (DoS) condition.
This issue affects:
Junos OS Evolved
To be affected by this issue, OFP needs to be enabled. Execute the following command to check if OFP is running and on which ports. [ show system connections | match ofp | match LISTEN ]Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
This issue was seen during production usage.
This issue has been assigned CVE-2024-21612.
The following software releases have been updated to resolve this specific issue:
Junos OS Evolved: 21.2R3-S7-EVO, 21.3R3-S5-EVO, 21.4R3-S5-EVO, 22.1R3-S4-EVO, 22.2R3-S3-EVO, 22.3R3-EVO, 22.4R2-EVO, 22.4R3-EVO, 23.2R1-EVO, and all subsequent releases.
This issue is being tracked as PR 1714333 which is visible on the Customer Support website.
Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).
In order to prevent this issue, following firewall filter need to be added for each OFP port.
[ firewall family inet filter mgmt-filter term discard_ofp from protocol tcp ]
[ firewall family inet filter mgmt-filter term discard_ofp from destination-port <ofp_port_1> ]
[ firewall family inet filter mgmt-filter term discard_ofp from destination-port <ofp_port_2> ]
[ firewall family inet filter mgmt-filter term discard_ofp then discard ]
[ firewall family inet filter mgmt-filter term 2 then accept ]
[ interfaces re0:mgmt-0 unit 0 family inet filter input mgmt-filter ]
[ interfaces re1:mgmt-0 unit 0 family inet filter input mgmt-filter ]
2024-01-10: Initial Publication 2024-01-25: Added statement in description that OFP needs to be running in order for the issue to occur. Modified the workaround to convey that all open OFP ports need to be filtered to avoid this issue.