An uncontrolled resource consumption vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series switches allows an attacker sending large amounts of legitimate traffic destined to the device to cause Interchassis Control Protocol (ICCP) interruptions, leading to an unstable control connection between the Multi-Chassis Link Aggregation Group (MC-LAG) nodes which can in turn lead to traffic loss. Continued receipt of this amount of traffic will create a sustained Denial of Service (DoS) condition. An indication that the system could be impacted by this issue is the following log message: "DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception LOCALNH:aggregate exceeded its allowed bandwidth at fpc <fpc number> for <n> times, started at <timestamp>" This issue affects Juniper Networks Junos OS on QFX5000 Series and EX4600 Series: 15.1 versions prior to 15.1R7-S9; 17.3 versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S13, 17.4R3-S5; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R2-S8, 18.4R3-S7; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R1-S6, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S2; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R2; 20.4 versions prior to 20.4R1-S1, 20.4R2.

Project Subscriptions

Vendors Products
Juniper Subscribe
Ex4200-vc Subscribe
Ex4300-24p Subscribe
Ex4300-24p-s Subscribe
Ex4300-24t Subscribe
Ex4300-24t-s Subscribe
Ex4300-32f Subscribe
Ex4300-32f-dc Subscribe
Ex4300-32f-s Subscribe
Ex4300-48mp Subscribe
Ex4300-48mp-s Subscribe
Ex4300-48p Subscribe
Ex4300-48p-s Subscribe
Ex4300-48t Subscribe
Ex4300-48t-afi Subscribe
Ex4300-48t-dc Subscribe
Ex4300-48t-dc-afi Subscribe
Ex4300-48t-s Subscribe
Ex4300-48tafi Subscribe
Ex4300-48tdc Subscribe
Ex4300-48tdc-afi Subscribe
Ex4300-mp Subscribe
Ex4300-vc Subscribe
Ex4300m Subscribe
Ex4500-vc Subscribe
Ex4550-vc Subscribe
Ex4550\/vc Subscribe
Ex4600-vc Subscribe
Qfx5100 Subscribe
Qfx5100-96s Subscribe
Qfx5110 Subscribe
Qfx5120 Subscribe
Qfx5130 Subscribe
Qfx5200 Subscribe
Qfx5200-32c Subscribe
Qfx5200-48y Subscribe
Qfx5210 Subscribe
Qfx5210-64c Subscribe
Qfx5220 Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2021-2904 An uncontrolled resource consumption vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series switches allows an attacker sending large amounts of legitimate traffic destined to the device to cause Interchassis Control Protocol (ICCP) interruptions, leading to an unstable control connection between the Multi-Chassis Link Aggregation Group (MC-LAG) nodes which can in turn lead to traffic loss. Continued receipt of this amount of traffic will create a sustained Denial of Service (DoS) condition. An indication that the system could be impacted by this issue is the following log message: "DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception LOCALNH:aggregate exceeded its allowed bandwidth at fpc <fpc number> for <n> times, started at <timestamp>" This issue affects Juniper Networks Junos OS on QFX5000 Series and EX4600 Series: 15.1 versions prior to 15.1R7-S9; 17.3 versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S13, 17.4R3-S5; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R2-S8, 18.4R3-S7; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R1-S6, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S2; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R2; 20.4 versions prior to 20.4R1-S1, 20.4R2.
Fixes

Solution

The following software releases have been updated to resolve this specific issue: 15.1R7-S9, 17.3R3-S11, 17.4R2-S13, 17.4R3-S5, 18.1R3-S13, 18.2R3-S8, 18.3R3-S5, 18.4R2-S8, 18.4R3-S7, 19.1R3-S5, 19.2R1-S6, 19.2R3-S2, 19.3R2-S6, 19.3R3-S2, 19.4R1-S4, 19.4R2-S4, 19.4R3-S2, 20.1R2-S2, 20.1R3, 20.2R2-S3, 20.2R3, 20.3R2, 20.4R1-S1, 20.4R2, 21.1R1, and all subsequent releases.


Workaround

While no complete workaround exists, the risk of malicious exploitation can be reduced by filtering undesirable traffic using firewall filters and policers, or increase the bandwidth for the localnh DDOS queue.

References
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2024-09-16T16:33:37.636Z

Reserved: 2020-10-27T00:00:00

Link: CVE-2021-0285

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-07-15T20:15:10.253

Modified: 2024-11-21T05:42:24.200

Link: CVE-2021-0285

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses