We detected a software forced router crash - and as we see the trigger was an cli command for key-chain addition.
{master}[edit]
root@JTAC-re0# set security authentication-key-chains key-chain BGP-RR-KEYCHAIN key 0 start-time 2020-01-01.01:01
root@JTAC-re0# commit
re0:
configuration check succeeds
re1:
commit complete
client_loop: send disconnect: Broken pipe
root@JTAC-re0> show system core-dumps no-forwarding
--------------------------------------------------------------------------
-rw------- 1 root root 953154791 Jul 9 08:29 /var/core/re0/vmcore.2025-07-09_06-26-43.tar.gz
total files: 1
-rw------- 1 root root 477739419 Jul 9 08:27 /var/core/re1/vmcore.2025-07-09_06-24-36.tar.gz
Keychain Tolerance max (4294967295) value was configured during file propagate to /var/etc/keyadmin.conf. This value translated to -1 because of format specifier (%d).
Kernel, while processing the arguments, attempts to interpret -1 as an unsigned value, which causes subsequent arguments to be updated with incorrect or garbage values.
As a result, the database is updated with invalid data. When subsequent commit happened, kernel tried to read existing keys, one of key member is NULL, leading to vmcore.
If the tolerance for the key-chain is configured as max value (4294967295) and committed then if a new key-id is added to the key-chain and a commit is made it results in a crash for all Junos Evolved devices.
Example as below:
1) create a keychain (with by default tolerance is 3600)
set security authentication-key-chains key-chain test_keychain1 key 1 secret "xxxxx"
set security authentication-key-chains key-chain test_keychain1 key 1 start-time "2025-7-22.01:40:00 +0530"
commit
2) Now change the keychain tolerance to max value 4294967295
set security authentication-key-chains key-chain test_keychain1 tolerance 4294967295
3) Add new key 0 to same keychain
set security authentication-key-chains key-chain test_keychain1 key 0 secret "yyyyy"
set security authentication-key-chains key-chain test_keychain1 key 0 start-time "2025-7-23.09:00:00 +0530"
Kernel will crash at 3rd commit stage.
This is fixed via below PR.
http://prsearch.juniper.net/problemreport/PR1895827