cbcvebase.
CVE-2020-1649
published 2020-07-17

CVE-2020-1649: When a device running Juniper Networks Junos OS with MPC7, MPC8, or MPC9 line cards installed and the system is configured for inline IP reassembly, used by…

high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
When a device running Juniper Networks Junos OS with MPC7, MPC8, or MPC9 line cards installed and the system is configured for inline IP reassembly, used by L2TP, MAP-E, GRE, and IPIP, the packet forwarding engine (PFE) will become disabled upon receipt of small fragments requiring reassembly, generating the following error messages: [LOG: Err] MQSS(2): WO: Packet Error - Error Packets 1, Connection 29 [LOG: Err] eachip_hmcif_rx_intr_handler(7259): EA[2:0]: HMCIF Rx: Injected checksum error detected on WO response - Chunk Address 0x0 [LOG: Err] MQSS(2): DRD: RORD1: CMD reorder ID error - Command 11, Reorder ID 1960, QID 0 [LOG: Err] MQSS(2): DRD: UNROLL0: HMC chunk address error in stage 5 - Chunk Address: 0xc38fb1 [LOG: Notice] Error: /fpc/0/pfe/0/cm/0/MQSS(2)/2/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc), scope: pfe, category: functional, severity: major, module: MQSS(2), type: DRD_RORD_ENG_INT: CMD FSM State Error [LOG: Notice] Performing action cmalarm for error /fpc/0/pfe/0/cm/0/MQSS(2)/2/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(2) with scope: pfe category: functional level: major [LOG: Notice] Performing action get-state for error /fpc/0/pfe/0/cm/0/MQSS(2)/2/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(2) with scope: pfe category: functional level: major [LOG: Notice] Performing action disable-pfe for error /fpc/0/pfe/0/cm/0/MQSS(2)/2/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(2) with scope: pfe category: functional level: major By continuously sending fragmented packets that cannot be reassembled, an attacker can repeatedly disable the PFE causing a sustained Denial of Service (DoS). This issue affects Juniper Networks Junos OS: 17.2 versions prior to 17.2R3-S4 on MX Series; 17.3 versions prior to 17.3R3-S8 on MX Series; 17.4 versions prior to 17.4R2-S9, 17.4R3-S1 on MX Series; 18.1 versions prior to 18.1R3-S10 on MX Series; 18.2 vers

Affected

24 ranges
VendorProductVersion rangeFixed in
juniperjunos——
juniperjunos——
juniperjunos——
juniperjunos——
juniperjunos——
juniperjunos——
juniperjunos——
juniperjunos——
juniperjunos——
juniperjunos——
juniperjunos——
juniperjunos_os——
junipermx_series——
juniper_networksjunos_os>= 17.2 < 17.2R3-S417.2R3-S4
juniper_networksjunos_os>= 17.3 < 17.3R3-S817.3R3-S8
juniper_networksjunos_os>= 17.4 < 17.4R2-S9, 17.4R3-S117.4R2-S9, 17.4R3-S1
juniper_networksjunos_os>= 18.1 < 18.1R3-S1018.1R3-S10
juniper_networksjunos_os>= 18.2 < 18.2R2-S6, 18.2R3-S318.2R2-S6, 18.2R3-S3
juniper_networksjunos_os>= 18.2X75 < 18.2X75-D34, 18.2X75-D41, 18.2X75-D53, 18.2X75-D65, 18.2X75-D43018.2X75-D34, 18.2X75-D41, 18.2X75-D53, 18.2X75-D65, 18.2X75-D430
juniper_networksjunos_os>= 18.3 < 18.3R1-S7, 18.3R2-S4, 18.3R3-S218.3R1-S7, 18.3R2-S4, 18.3R3-S2
juniper_networksjunos_os>= 18.4 < 18.4R1-S6, 18.4R2-S4, 18.4R318.4R1-S6, 18.4R2-S4, 18.4R3
juniper_networksjunos_os>= 19.1 < 19.1R1-S4, 19.1R2-S1, 19.1R319.1R1-S4, 19.1R2-S1, 19.1R3
juniper_networksjunos_os>= 19.2 < 19.2R1-S3, 19.2R219.2R1-S3, 19.2R2
juniper_networksjunos_os>= 19.3 < 19.3R2-S2, 19.3R319.3R2-S2, 19.3R3