CVE-2021-0270

{"containers": {"cna": {"affected": [{"platforms": ["PTX Series, QFX10K Series"], "product": "Junos OS", "vendor": "Juniper Networks", "versions": [{"changes": [{"at": "18.1R3-S10", "status": "affected"}], "lessThan": "18.1*", "status": "affected", "version": "18.1R2", "versionType": "custom"}]}], "configurations": [{"lang": "en", "value": "The inline flow monitoring configuration can be broadly classified into the following categories:\n\nConfigurations at the [edit services flow-monitoring version-ipfix template] or [edit services flow-monitoring version9 template] hierarchy level\u2014At this level, you configure the template properties for inline flow monitoring.\nConfigurations at the [edit forwarding-options sampling instance] hierarchy level\u2014At this level, you configure a sampling instance and associate the template to the sampling instance. At this level, you also configure the flow-server IP address and port number as well as the autonomous system type.\nConfigurations at the [edit chassis fpc] hierarchy level\u2014At this level, you associate the sampling instance with the FPC on which the media interface is present.\nConfigurations at the [edit firewall] hierarchy level\u2014At this level you configure a firewall filter for the family of traffic to be sampled. You must attach this filter to the interface on which you want to sample the traffic.\n\nSee https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/inline-flow-monitoring-ptx.html for further details."}], "datePublic": "2021-04-14T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "On PTX Series and QFX10k Series devices with the \"inline-jflow\" feature enabled, a use after free weakness in the Packet Forwarding Engine (PFE) microkernel architecture of Juniper Networks Junos OS may allow an attacker to cause a Denial of Service (DoS) condition whereby one or more Flexible PIC Concentrators (FPCs) may restart. As this is a race condition situation this issue become more likely to be hit when network instability occurs, such as but not limited to BGP/IGP reconvergences, and/or further likely to occur when more active \"traffic flows\" are occurring through the device. When this issue occurs, it will cause one or more FPCs to restart unexpectedly. During FPC restarts core files will be generated. While the core file is generated traffic will be disrupted. Sustained receipt of large traffic flows and reconvergence-like situations may sustain the Denial of Service (DoS) situation. This issue affects: Juniper Networks Junos OS: 18.1 version 18.1R2 and later versions prior to 18.1R3-S10 on PTX Series, QFX10K Series."}], "exploits": [{"lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "description": "CWE-362 Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization)", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-04-22T19:37:26.000Z", "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://kb.juniper.net/JSA11161"}, {"tags": ["x_refsource_MISC"], "url": "https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/inline-flow-monitoring-ptx.html"}], "solutions": [{"lang": "en", "value": "The following software releases have been updated to resolve this specific issue: 16.1R7-S8, 17.2R3-S4, 17.3R3-S8, 17.4R2-S11, 17.4R3-S2, 18.1R3-S10, 18.2R1, and all subsequent releases."}], "source": {"advisory": "JSA11161", "defect": ["1498427"], "discovery": "USER"}, "title": "Junos OS: PTX Series, QFX10K Series: A PTX/QFX FPC may restart unexpectedly with the \"inline-Jflow\" feature enabled on a large-scale deployment", "workarounds": [{"lang": "en", "value": "If you are susceptible to this issue and unable to upgrade to software with the fix, you can deploy a workaround by disabling the \u201cinline-flow\u201d feature.\n\nTo check for use and to disable the \u201cinline-jflow\u201d service on a device, see https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/inline-flow-monitoring-ptx.html for additional details.\n\nRemoving \u201cinline-jflow\u201d takes effect immediately and there is no need to restart the FPCs or the router. Once the feature is removed, the router no longer provides traffic data to the flow collector."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "sirt@juniper.net", "DATE_PUBLIC": "2021-04-14T16:00:00.000Z", "ID": "CVE-2021-0270", "STATE": "PUBLIC", "TITLE": "Junos OS: PTX Series, QFX10K Series: A PTX/QFX FPC may restart unexpectedly with the \"inline-Jflow\" feature enabled on a large-scale deployment"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Junos OS", "version": {"version_data": [{"platform": "PTX Series, QFX10K Series", "version_affected": ">=", "version_name": "18.1", "version_value": "18.1R2"}, {"platform": "PTX Series, QFX10K Series", "version_affected": "!<", "version_name": "18.1", "version_value": "18.1R3-S10"}]}}]}, "vendor_name": "Juniper Networks"}]}}, "configuration": [{"lang": "en", "value": "The inline flow monitoring configuration can be broadly classified into the following categories:\n\nConfigurations at the [edit services flow-monitoring version-ipfix template] or [edit services flow-monitoring version9 template] hierarchy level\u2014At this level, you configure the template properties for inline flow monitoring.\nConfigurations at the [edit forwarding-options sampling instance] hierarchy level\u2014At this level, you configure a sampling instance and associate the template to the sampling instance. At this level, you also configure the flow-server IP address and port number as well as the autonomous system type.\nConfigurations at the [edit chassis fpc] hierarchy level\u2014At this level, you associate the sampling instance with the FPC on which the media interface is present.\nConfigurations at the [edit firewall] hierarchy level\u2014At this level you configure a firewall filter for the family of traffic to be sampled. You must attach this filter to the interface on which you want to sample the traffic.\n\nSee https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/inline-flow-monitoring-ptx.html for further details."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "On PTX Series and QFX10k Series devices with the \"inline-jflow\" feature enabled, a use after free weakness in the Packet Forwarding Engine (PFE) microkernel architecture of Juniper Networks Junos OS may allow an attacker to cause a Denial of Service (DoS) condition whereby one or more Flexible PIC Concentrators (FPCs) may restart. As this is a race condition situation this issue become more likely to be hit when network instability occurs, such as but not limited to BGP/IGP reconvergences, and/or further likely to occur when more active \"traffic flows\" are occurring through the device. When this issue occurs, it will cause one or more FPCs to restart unexpectedly. During FPC restarts core files will be generated. While the core file is generated traffic will be disrupted. Sustained receipt of large traffic flows and reconvergence-like situations may sustain the Denial of Service (DoS) situation. This issue affects: Juniper Networks Junos OS: 18.1 version 18.1R2 and later versions prior to 18.1R3-S10 on PTX Series, QFX10K Series."}]}, "exploit": [{"lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-362 Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization)"}]}, {"description": [{"lang": "eng", "value": "CWE-416 Use After Free"}]}]}, "references": {"reference_data": [{"name": "https://kb.juniper.net/JSA11161", "refsource": "MISC", "url": "https://kb.juniper.net/JSA11161"}, {"name": "https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/inline-flow-monitoring-ptx.html", "refsource": "MISC", "url": "https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/inline-flow-monitoring-ptx.html"}]}, "solution": [{"lang": "en", "value": "The following software releases have been updated to resolve this specific issue: 16.1R7-S8, 17.2R3-S4, 17.3R3-S8, 17.4R2-S11, 17.4R3-S2, 18.1R3-S10, 18.2R1, and all subsequent releases."}], "source": {"advisory": "JSA11161", "defect": ["1498427"], "discovery": "USER"}, "work_around": [{"lang": "en", "value": "If you are susceptible to this issue and unable to upgrade to software with the fix, you can deploy a workaround by disabling the \u201cinline-flow\u201d feature.\n\nTo check for use and to disable the \u201cinline-jflow\u201d service on a device, see https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/inline-flow-monitoring-ptx.html for additional details.\n\nRemoving \u201cinline-jflow\u201d takes effect immediately and there is no need to restart the FPCs or the router. Once the feature is removed, the router no longer provides traffic data to the flow collector."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:32:10.526Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://kb.juniper.net/JSA11161"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/inline-flow-monitoring-ptx.html"}]}]}, "cveMetadata": {"assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "assignerShortName": "juniper", "cveId": "CVE-2021-0270", "datePublished": "2021-04-22T19:37:26.359Z", "dateReserved": "2020-10-27T00:00:00.000Z", "dateUpdated": "2024-09-16T19:04:41.792Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"platforms": ["PTX Series, QFX10K Series"], "product": "Junos OS", "vendor": "Juniper Networks", "versions": [{"changes": [{"at": "18.1R3-S10", "status": "affected"}], "lessThan": "18.1*", "status": "affected", "version": "18.1R2", "versionType": "custom"}]}], "source": "sirt@juniper.net"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:18.1:r2:*:*:*:*:*:*", "matchCriteriaId": "2EF6F4C1-6A7E-474F-89BC-7A3C50FD8CAC", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r2-s1:*:*:*:*:*:*", "matchCriteriaId": "84F5BCBA-404B-4BC9-B363-CE6D231B0D6D", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r2-s2:*:*:*:*:*:*", "matchCriteriaId": "18A4CA3E-DA61-49CC-8476-3A476CCB2B83", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r2-s4:*:*:*:*:*:*", "matchCriteriaId": "A7380B3E-09F5-4497-86C6-11EF56BD89F1", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r3:*:*:*:*:*:*", "matchCriteriaId": "658841A9-BEC9-433E-81D0-47DE82887C4F", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s1:*:*:*:*:*:*", "matchCriteriaId": "5AD05209-1274-4F8A-9FA2-A1A8DFCC5755", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s2:*:*:*:*:*:*", "matchCriteriaId": "C97683B3-A07B-428F-9535-C49B55305679", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s3:*:*:*:*:*:*", "matchCriteriaId": "A14CE132-C56B-43D8-A248-AB6A2D1A7B6C", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s4:*:*:*:*:*:*", "matchCriteriaId": "73978DD8-BD92-4872-8F35-AF2B9BCA1ECB", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s5:*:*:*:*:*:*", "matchCriteriaId": "678F57D1-2595-4AF3-BB87-AF2E1FE3CBB9", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s6:*:*:*:*:*:*", "matchCriteriaId": "7988CE92-71D2-4EEC-B596-4A60E2C1136A", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s7:*:*:*:*:*:*", "matchCriteriaId": "330D176F-8DAD-440C-A623-44FA233FAB01", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s8:*:*:*:*:*:*", "matchCriteriaId": "8CC5EAB8-1364-4325-9F01-BE7CC479C29D", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s9:*:*:*:*:*:*", "matchCriteriaId": "4E2E933A-852F-4257-860D-09638EE0D2F3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:juniper:ptx1000:-:*:*:*:*:*:*:*", "matchCriteriaId": "0E6DF99D-E438-4943-BC32-F2821E72AE0B", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:ptx10001-36mr:-:*:*:*:*:*:*:*", "matchCriteriaId": "C188428C-0558-44FB-845C-E885DE9A0733", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:ptx10002:-:*:*:*:*:*:*:*", "matchCriteriaId": "82B22AC2-B794-4F12-9EB3-9AA6E4B19831", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:ptx10003:-:*:*:*:*:*:*:*", "matchCriteriaId": "5BD05415-9F94-4EB8-805A-C9C0FFA9D0DF", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:ptx10004:-:*:*:*:*:*:*:*", "matchCriteriaId": "C432E543-37F5-4CA0-B239-2B97C6A16907", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:ptx10008:-:*:*:*:*:*:*:*", "matchCriteriaId": "65A64A26-4606-4D33-8958-5A3B7FFC4CDB", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:ptx10016:-:*:*:*:*:*:*:*", "matchCriteriaId": "1879799F-18B2-4958-AA90-FD19348C889F", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:ptx3000:-:*:*:*:*:*:*:*", "matchCriteriaId": "516476F9-7D4C-494F-99AA-750F4467CD15", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:ptx5000:-:*:*:*:*:*:*:*", "matchCriteriaId": "654140A0-FEC0-4DB4-83BF-ECCB000DFA4D", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10002:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1401145-D8EC-4DB9-9CDE-9DE6C0D000C5", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:*", "matchCriteriaId": "1453E42A-77B3-4922-8EC3-1A5668C39550", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:*", "matchCriteriaId": "26408465-BD6A-4416-B98E-691A5F651080", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "On PTX Series and QFX10k Series devices with the \"inline-jflow\" feature enabled, a use after free weakness in the Packet Forwarding Engine (PFE) microkernel architecture of Juniper Networks Junos OS may allow an attacker to cause a Denial of Service (DoS) condition whereby one or more Flexible PIC Concentrators (FPCs) may restart. As this is a race condition situation this issue become more likely to be hit when network instability occurs, such as but not limited to BGP/IGP reconvergences, and/or further likely to occur when more active \"traffic flows\" are occurring through the device. When this issue occurs, it will cause one or more FPCs to restart unexpectedly. During FPC restarts core files will be generated. While the core file is generated traffic will be disrupted. Sustained receipt of large traffic flows and reconvergence-like situations may sustain the Denial of Service (DoS) situation. This issue affects: Juniper Networks Junos OS: 18.1 version 18.1R2 and later versions prior to 18.1R3-S10 on PTX Series, QFX10K Series."}, {"lang": "es", "value": "En los dispositivos de la serie PTX y la serie QFX10k con la funcionalidad \"inline-jflow\" habilitada, un uso de la memoria previamente liberada en la arquitectura de microkernel de Packet Forwarding Engine (PFE) de Juniper Networks, puede permitir a un atacante causar una Denegaci\u00f3n de Servicio (DoS) condici\u00f3n por la cual uno o m\u00e1s Flexible PIC Concentrators (FPCs) pueden reiniciarse. Como se trata de una situaci\u00f3n de condici\u00f3n de carrera, es m\u00e1s probable que ocurra este problema cuando se produce una inestabilidad de la red, como, entre otros, las reconvergencias de BGP/IGP, y/o es m\u00e1s probable que ocurra cuando se produzcan \"traffic flows\" m\u00e1s activos por medio del dispositivo. Cuando este problema ocurre, causar\u00e1 uno o m\u00e1s FPC se reiniciar\u00e1n inesperadamente. Durante los reinicios de FPC, se generar\u00e1n archivos core. Mientras se genera el archivo principal, el tr\u00e1fico estar\u00e1 interrumpido. La recepci\u00f3n sostenida de grandes flujos de tr\u00e1fico y situaciones similares a la reconvergencia pueden sustentar la situaci\u00f3n de Denegaci\u00f3n de Servicio (DoS). Este problema afecta a: Juniper Networks Junos OS: versiones 18.1 18.1R2 y posteriores versiones anteriores a 18.1R3-S10 en la serie PTX, serie QFX10K"}], "id": "CVE-2021-0270", "lastModified": "2026-06-17T03:29:40.087", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "sirt@juniper.net", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-04-22T20:15:10.017", "references": [{"source": "sirt@juniper.net", "tags": ["Vendor Advisory"], "url": "https://kb.juniper.net/JSA11161"}, {"source": "sirt@juniper.net", "tags": ["Vendor Advisory"], "url": "https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/inline-flow-monitoring-ptx.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://kb.juniper.net/JSA11161"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/inline-flow-monitoring-ptx.html"}], "sourceIdentifier": "sirt@juniper.net", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}, {"lang": "en", "value": "CWE-416"}], "source": "sirt@juniper.net", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-362"}, {"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}