Junos OS: MX Series: In DS-lite and NAT scenario receipt of crafted IPv6 traffic causes port block

Summary

An Improper Check for Unusual or Exceptional Conditions vulnerability in the pfe (packet forwarding engine) of Juniper Networks Junos OS on MX Series causes a port within a pool to be blocked leading to Denial of Service (DoS). In a DS-Lite (Dual-Stack Lite) and NAT (Network Address Translation) scenario, when crafted IPv6 traffic is received and prefix-length is set to 56, the ports assigned to the user will not be freed.  Eventually, users cannot establish new connections. Affected FPC/PIC need to be manually restarted to recover. Following is the command to identify the issue:      user@host> show services nat source port-block      Host_IP                     External_IP                   Port_Block      Ports_Used/       Block_State/                                                               Range           Ports_Total       Left_Time(s)     2001::                        x.x.x.x                     58880-59391     256/256*1         Active/-       >>>>>>>>port still usedThis issue affects Junos OS on MX Series:  • from 21.2 before 21.2R3-S8,  • from 21.4 before 21.4R3-S7,  • from 22.1 before 22.1R3-S6,  • from 22.2 before 22.2R3-S4,  • from 22.3 before 22.3R3-S3,  • from 22.4 before 22.4R3-S2,  • from 23.2 before 23.2R2-S1,  • from 23.4 before 23.4R1-S2, 23.4R2. This issue does not affect versions before 20.2R1.

Timeline

1. Apr 9, 2025, 7:49 PM UTCCVE published
2. Apr 10, 2025, 1:13 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Apr 10, 2025, 1:14 PM UTCRecord last updated

Affected versions

• Juniper Networks Junos OS

  fixed in 21.2R3-S8; From 21.4 · fixed in 21.4R3-S7; From 22.1 · fixed in 22.1R3-S6; From 22.2 · fixed in 22.2R3-S4; From 22.3 · fixed in 22.3R3-S3; From 22.4 · fixed in 22.4R3-S2; From 23.2 · fixed in 23.2R2-S1

References 1