title: Junos OS Evolved: PTX series: An attacker sending a crafted GRE packet will cause the PFE to restart
description: An Improper Check for Unusual or Exceptional Conditions vulnerability in the packetIO daemon of Juniper Networks Junos OS Evolved on PTX10003, PTX10004, and PTX10008 allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). Continued receipt of these crafted packets will cause a sustained Denial of Service condition. This issue affects Juniper Networks Junos OS Evolved all versions prior to 20.4R2-S3-EVO on PTX10003, PTX10004, and PTX10008. This issue does not affect: Juniper Networks Junos OS Evolved versions 21.1R1-EVO and above; Juniper Networks Junos OS.
problem types: CWE-754 Improper Check for Unusual or Exceptional Conditions
affected:
{
platforms: PTX10003, PTX10004, PTX10008
product: Junos OS Evolved
vendor: Juniper Networks
versions:
lessThan: 20.4R2-S3-EVO, 20.4R3-EVO, status: affected, version: unspecified, versionType: custom
}
{
product: Junos OS Evolved
vendor: Juniper Networks
versions:
lessThan: 21.1*, status: unaffected, version: 21.1R1-EVO, versionType: custom
}
{
product: Junos OS
vendor: Juniper Networks
versions:
status: unaffected, version: any
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: The following software releases have been updated to resolve this specific issue: 20.4R2-S3-EVO, 20.4R3-EVO.
workarounds: One characteristic of this vulnerability is that an FPC restart will only be triggered by a crafted GRE packet which has its' TTL set to 0 or 1 so as a workaround a filter can be implemented that drops such packets:
set firewall family inet filter GREfilter term 1 from protocol gre
set firewall family inet filter GREfilter term 1 from ttl 0
set firewall family inet filter GREfilter term 1 then count gre-ttl-0
set firewall family inet filter GREfilter term 1 then discard
set firewall family inet filter GREfilter term 2 from protocol gre
set firewall family inet filter GREfilter term 2 from ttl 1
set firewall family inet filter GREfilter term 2 then count gre-ttl-1
set firewall family inet filter GREfilter term 2 then discard
set firewall family inet filter GREfilter term default then accept
An equivalent filter for family inet6 is required if IPv6 is configured on at least one interface.