PT-2021-3983 · Juniper Networks · Junos

Published

2021-07-14

·

Updated

2021-07-29

·

CVE-2021-0293

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 18.2R2-S8, 18.2R3-S7 Juniper Networks Junos OS versions prior to 18.3R3-S4 Juniper Networks Junos OS versions prior to 18.4R1-S8, 18.4R2-S6, 18.4R3-S7 Juniper Networks Junos OS versions prior to 19.1R1-S6, 19.1R2-S2, 19.1R3-S4 Juniper Networks Junos OS versions prior to 19.2R1-S6, 19.2R3-S2 Juniper Networks Junos OS versions prior to 19.3R2-S6, 19.3R3-S1 Juniper Networks Junos OS versions prior to 19.4R1-S4, 19.4R2-S3, 19.4R3-S1 Juniper Networks Junos OS versions prior to 20.1R2 Juniper Networks Junos OS versions prior to 20.2R2-S1, 20.2R3 Juniper Networks Junos OS versions prior to 20.3R1-S1, 20.3R2
Description A vulnerability in Juniper Networks Junos OS caused by Missing Release of Memory after Effective Lifetime leads to a memory leak each time the CLI command 'show system connections extensive' is executed. The amount of memory leaked on each execution depends on the number of TCP connections from and to the system. Repeated execution will cause more memory to leak and eventually daemons that need to allocate additional memory and ultimately the kernel to crash, which will result in traffic loss. Continued execution of this command will cause a sustained Denial of Service (DoS) condition. An administrator can use the following CLI command to monitor for increase in memory consumption of the netstat process, if it exists: user@junos> show system processes extensive | match "username|netstat". The following log message might be observed if this issue happens: kernel: %KERN-3: pid 21181 (netstat), uid 0, was killed: out of swap space.
Recommendations For Juniper Networks Junos OS versions prior to 18.2R2-S8, 18.2R3-S7, update to a fixed version. For Juniper Networks Junos OS versions prior to 18.3R3-S4, update to a fixed version. For Juniper Networks Junos OS versions prior to 18.4R1-S8, 18.4R2-S6, 18.4R3-S7, update to a fixed version. For Juniper Networks Junos OS versions prior to 19.1R1-S6, 19.1R2-S2, 19.1R3-S4, update to a fixed version. For Juniper Networks Junos OS versions prior to 19.2R1-S6, 19.2R3-S2, update to a fixed version. For Juniper Networks Junos OS versions prior to 19.3R2-S6, 19.3R3-S1, update to a fixed version. For Juniper Networks Junos OS versions prior to 19.4R1-S4, 19.4R2-S3, 19.4R3-S1, update to a fixed version. For Juniper Networks Junos OS versions prior to 20.1R2, update to a fixed version. For Juniper Networks Junos OS versions prior to 20.2R2-S1, 20.2R3, update to a fixed version. For Juniper Networks Junos OS versions prior to 20.3R1-S1, 20.3R2, update to a fixed version. As a temporary workaround, consider restricting the use of the 'show system connections extensive' command until a patch is available.

Fix

DoS

Memory Leak

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2021-04504
CVE-2021-0293

Affected Products

Junos