CVE-2021-0211: Juniper Junos BGP FlowSpec DoS Flaw

CVE-2021-0211 Overview

CVE-2021-0211 is a critical vulnerability in Juniper Networks Junos OS and Junos OS Evolved that affects the Routing Protocol Daemon (RPD) service. The vulnerability stems from an improper check for unusual or exceptional conditions when processing BGP FlowSpec messages. An attacker can exploit this flaw by sending valid BGP FlowSpec messages that cause unexpected changes in route advertisements within the BGP FlowSpec domain, leading to network traffic disruptions and a Denial of Service (DoS) condition.

The vulnerability is particularly dangerous because it can be exploited remotely over the network without requiring authentication or user interaction. Continued receipt of malicious BGP FlowSpec update messages will sustain the DoS condition, making this a significant threat to network infrastructure availability.

Critical Impact

This vulnerability enables remote attackers to disrupt network routing through malicious BGP FlowSpec messages, causing sustained network traffic disruptions and Denial of Service conditions across affected Juniper infrastructure.

Affected Products

• Juniper Junos OS (multiple versions from 15.1 through 20.3)
• Juniper Junos OS Evolved (versions prior to 20.3R1-S1-EVO, 20.3R2-EVO)
• Juniper SRX Series Firewalls (SRX100 through SRX5800)
• Juniper EX Series Ethernet Switches (EX2200 through EX9253)

Discovery Timeline

• January 15, 2021 - CVE-2021-0211 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-0211

Vulnerability Analysis

This vulnerability is classified under CWE-754 (Improper Check for Unusual or Exceptional Conditions). The flaw exists within the Routing Protocol Daemon (RPD) service, which is responsible for handling routing protocol operations including BGP (Border Gateway Protocol) FlowSpec processing.

BGP FlowSpec is an extension to BGP that allows network operators to distribute traffic flow specifications for DDoS mitigation and traffic filtering. The vulnerability occurs because the RPD service fails to properly validate certain conditions when processing incoming BGP FlowSpec messages. This allows an attacker with BGP peering access to send specially crafted but technically valid FlowSpec messages that trigger unexpected behavior in route advertisement processing.

The attack can be executed remotely over the network and requires no authentication, making it accessible to any attacker who can establish or hijack a BGP session with a vulnerable device. The scope of impact extends beyond the vulnerable component itself, affecting the broader network routing domain.

Root Cause

The root cause is an improper validation of exceptional conditions in the BGP FlowSpec message processing logic within the Routing Protocol Daemon. When the RPD receives certain valid but unusual BGP FlowSpec messages, it fails to handle the conditions appropriately, resulting in unintended modifications to route advertisements. This lack of proper bounds checking and condition validation allows the routing table to be manipulated in ways that disrupt normal traffic flow.

Attack Vector

The attack vector is network-based, requiring the attacker to send BGP FlowSpec messages to the vulnerable device. The attack scenario involves:

1. An attacker establishes or leverages an existing BGP session with a vulnerable Juniper device
2. The attacker crafts valid BGP FlowSpec update messages designed to trigger the improper condition handling
3. Upon receipt, the vulnerable RPD processes these messages and makes unexpected changes to route advertisements
4. These route advertisement changes propagate through the BGP FlowSpec domain, causing network traffic disruptions
5. Continued transmission of malicious messages sustains the Denial of Service condition

The attack does not require valid credentials and can affect routing across the entire BGP FlowSpec domain, potentially impacting multiple downstream networks and services.

Detection Methods for CVE-2021-0211

Indicators of Compromise

• Unexpected changes in BGP FlowSpec route advertisements that do not correlate with legitimate network changes
• Anomalous traffic patterns indicating route manipulation or traffic black-holing
• RPD service instability or unexpected restarts on Juniper devices
• BGP session flapping or unusual peer behavior

Detection Strategies

• Monitor BGP FlowSpec route updates for unauthorized or unexpected modifications using network monitoring tools
• Implement alerting on sudden changes in traffic patterns that may indicate route manipulation
• Review RPD logs for error messages related to BGP FlowSpec processing anomalies
• Deploy network traffic analysis to detect unusual BGP message patterns from peering sessions

Monitoring Recommendations

• Enable detailed logging for BGP and RPD services on all affected Juniper devices
• Establish baseline metrics for BGP FlowSpec route advertisements and alert on deviations
• Monitor system resource utilization on network devices as sustained attacks may cause performance degradation
• Implement BGP route monitoring and validation to detect unauthorized route changes

How to Mitigate CVE-2021-0211

Immediate Actions Required

• Identify all Juniper devices running vulnerable versions of Junos OS or Junos OS Evolved
• Apply the vendor-provided patches as documented in the Juniper Security Advisory JSA11101
• Review BGP peering configurations and ensure only authorized peers can establish sessions
• Implement BGP security best practices including route filtering and peer authentication

Patch Information

Juniper Networks has released patched versions for all affected software branches. The following minimum versions address the vulnerability:

• Junos OS 17.3R3-S10, 17.4R2-S12, 17.4R3-S4, 18.1R3-S12, 18.2R2-S8, 18.2R3-S6, 18.3R3-S4, 18.4R1-S8, 18.4R2-S6, 18.4R3-S6, 19.1R1-S6, 19.1R2-S2, 19.1R3-S3, 19.2R3-S1, 19.3R2-S5, 19.3R3-S1, 19.4R1-S3, 19.4R2-S3, 19.4R3, 20.1R2, 20.2R1-S3, 20.2R2, 20.3R1-S1, 20.3R2
• Junos OS Evolved 20.3R1-S1-EVO, 20.3R2-EVO
• Exception versions: 15.1X49-D240 on SRX Series and 15.1R7-S8 on EX Series are not affected

For detailed patch information and download links, refer to the Juniper Security Advisory JSA11101.

Workarounds

• Implement strict BGP prefix and route filtering to limit the scope of potential FlowSpec manipulation
• Configure BGP authentication (MD5 or TCP-AO) to prevent unauthorized BGP session establishment
• Use access control lists to restrict which hosts can establish BGP sessions with vulnerable devices
• Consider temporarily disabling BGP FlowSpec functionality if not operationally required until patching is complete

# Example: Configure BGP MD5 authentication on Junos OS
set protocols bgp group external-peers authentication-key "your-secure-key"
set protocols bgp group external-peers neighbor 192.0.2.1 authentication-key "your-secure-key"

# Example: Configure import policy to filter FlowSpec routes
set policy-options policy-statement flowspec-filter term deny-untrusted from protocol bgp
set policy-options policy-statement flowspec-filter term deny-untrusted from route-filter 0.0.0.0/0 prefix-length-range /0-/32
set policy-options policy-statement flowspec-filter term deny-untrusted then reject