A vulnerability in Juniper Networks Junos OS on vMX and MX150 devices may allow an attacker to cause a Denial of Service (DoS) by sending specific packets requiring special processing in microcode that the flow cache can't handle, causing the riot forwarding daemon to crash. By continuously sending the same specific packets, an attacker can repeatedly crash the riot process causing a sustained Denial of Service. Flow cache is specific to vMX based products and the MX150, and is enabled by default in performance mode. This issue can only be triggered by traffic destined to the device. Transit traffic will not cause the riot daemon to crash. When the issue occurs, a core dump and riot log file entry are generated. For example: /var/crash/core.J-UKERN.mpc0.1557255993.3864.gz /home/pfe/RIOT lo
The following software releases have been updated to resolve this specific issue: 18.1R3, 18.2R3, 18.2X75-D60, 18.3R3, 18.4R2, 19.1R2, 19.2R1, 19.3R1, and all subsequent releases.
There are no viable workarounds for this issue.
| Product | Vulnerable range | Fixed version | Advisory |
|---|---|---|---|
| Juniper Networks Junos OS | >=18.1<18.1R3 | 18.1R3 | advisory ↗ |
| Juniper Networks Junos OS | >=18.2<18.2R3 | 18.2R3 | advisory ↗ |
| Juniper Networks Junos OS | >=18.2X75<18.2X75-D60 | 18.2X75-D60 | advisory ↗ |
| Juniper Networks Junos OS | >=18.3<18.3R3 | 18.3R3 | advisory ↗ |
| Juniper Networks Junos OS | >=18.4<18.4R2 | 18.4R2 | advisory ↗ |
| Juniper Networks Junos OS | >=19.1<19.1R2 | 19.1R2 | advisory ↗ |