Junos OS and Junos OS Evolved: Specific packets can trigger rpd crash when BGP Origin Validation is configured with RPKI

Summary

On Juniper Networks Junos OS devices configured with BGP origin validation using Resource Public Key Infrastructure (RPKI) receipt of a specific packet from the RPKI cache server may cause routing process daemon (RPD) to crash and restart, creating a Denial of Service (DoS) condition. Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS 17.3 versions prior to 17.3R3-S12; 17.4 versions prior to 17.4R3-S5; 18.1 versions prior to 18.1R3-S13; 18.2 versions prior to 18.2R3-S8; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R2-S8, 18.4R3-S8; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R2-S4, 19.4R3-S3; 20.1 versions prior to 20.1R3; 20.2 versions prior to 20.2R3; 20.3 versions prior to 20.3R2; 20.4 versions prior to 20.4R2. Juniper Networks Junos OS Evolved All versions prior to 20.4R2-S2-EVO.

Timeline

1. Jul 15, 2021, 8:00 PM UTCCVE published
2. Sep 16, 2024, 6:08 PM UTCRecord last updated

Affected versions

• Juniper Networks Junos OS

  From 17.3 · fixed in 17.3R3-S12; From 17.4 · fixed in 17.4R3-S5; From 18.1 · fixed in 18.1R3-S13; From 18.2 · fixed in 18.2R3-S8; From 18.3 · fixed in 18.3R3-S5; From 19.1 · fixed in 19.1R3-S5; From 19.2 · fixed in 19.2R3-S2; From 20.1 · fixed in 20.1R3; From 20.2 · fixed in 20.2R3; From 20.3 · fixed in 20.3R2; From 20.4 · fixed in 20.4R2

• Juniper Networks Junos OS Evolved

  fixed in 20.4R2-S2-EVO

References 1