title: Junos OS Evolved: A high rate of specific traffic will cause a complete system outage
description:
An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).
If a high rate of specific valid packets are processed by the routing engine (RE) this will lead to a loss of connectivity of the RE with other components of the chassis and thereby a complete and persistent system outage. Please note that a carefully designed lo0 firewall filter will block or limit these packets which should prevent this issue from occurring.
The following log messages can be seen when this issue occurs:
<host> kernel: nf_conntrack: nf_conntrack: table full, dropping packet
This issue affects Juniper Networks Junos OS Evolved:
*  All versions earlier than 20.4R3-S7-EVO;
*  21.2R1-EVO and later versions;
*  21.4-EVO versions earlier than 21.4R3-S5-EVO;
*  22.1-EVO versions earlier than 22.1R3-S2-EVO;
*  22.2-EVO versions earlier than 22.2R3-EVO;
*  22.3-EVO versions earlier than 22.3R2-EVO;
*  22.4-EVO versions earlier than 22.4R2-EVO.
problem types: CWE-770 Allocation of Resources Without Limits or Throttling
affected:
{
defaultStatus: unaffected
product: Junos OS Evolved
vendor: Juniper Networks
versions:
lessThan: 20.4R3-S7-EVO, status: affected, version: 0, versionType: semver
lessThan: 21.2*-EVO, status: affected, version: 21.2-EVO, versionType: semver
lessThan: 21.4R3-S5-EVO, status: affected, version: 21.4-EVO, versionType: semver
lessThan: 22.1R3-S2-EVO, status: affected, version: 22.1-EVO, versionType: semver
lessThan: 22.2R3-EVO, status: affected, version: 22.2-EVO, versionType: semver
lessThan: 22.3R2-EVO, status: affected, version: 22.3-EVO, versionType: semver
lessThan: 22.4R2-EVO, status: affected, version: 22.4-EVO, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: The following software releases have been updated to resolve this specific issue: Junos OS Evolved 20.4R3-S7-EVO, 21.4R3-S5-EVO, 22.1R3-S2-EVO, 22.2R3-EVO, 22.3R2-EVO, 22.4R2-EVO, 23.2R1-EVO, and all subsequent releases.
workarounds: To prevent the device from receiving high rates of valid traffic please configure firewall filters to block unexpected and even throttle expected traffic.