CVE-2023-28967 Overview
A Use of Uninitialized Resource vulnerability exists in the Border Gateway Protocol (BGP) software of Juniper Networks Junos OS and Junos OS Evolved. This flaw allows an unauthenticated network-based attacker to send specific genuine BGP packets to a device configured with BGP, causing a Denial of Service (DoS) condition by crashing the Routing Protocol Daemon (rpd). The vulnerability is triggered when packets attempt to initiate a BGP connection before a BGP session is successfully established, and affects both iBGP and eBGP deployments.
Critical Impact
Network infrastructure running affected Junos OS versions can be taken offline by unauthenticated attackers, causing sustained routing disruptions across enterprise and service provider networks.
Affected Products
- Juniper Networks Junos OS versions 21.1R1 through 21.1R3-S4, 21.2R1 through 21.2R3-S1, 21.3R1 through 21.3R3-S1, 21.4 through 21.4R2-S2, 22.1 through 22.1R2-S2, and 22.2 through 22.2R1-S2
- Juniper Networks Junos OS Evolved versions 21.1R1-EVO through 21.4R2-S2-EVO, 22.1-EVO through 22.1R2-S1-EVO, and 22.2-EVO through 22.2R1-S1-EVO
- Versions prior to 21.1R1 (Junos OS) and 21.1R1-EVO (Junos OS Evolved) are not affected
Discovery Timeline
- 2023-04-17 - CVE-2023-28967 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2023-28967
Vulnerability Analysis
This vulnerability is classified as CWE-908: Use of Uninitialized Resource. The BGP implementation in affected Junos OS versions fails to properly initialize certain resources during BGP session establishment. When an attacker sends specific genuine BGP packets targeting a device configured with BGP, the Routing Protocol Daemon (rpd) attempts to access uninitialized memory, resulting in undefined behavior that leads to a daemon crash.
The vulnerability is particularly dangerous because it can be triggered before a BGP session is fully established, meaning standard BGP authentication mechanisms may not provide protection. The attack does not require the attacker to have established trust relationships or valid BGP peering configurations with the target device.
Root Cause
The root cause lies in improper resource initialization within the BGP protocol handling code. When processing incoming BGP connection attempts, the rpd daemon accesses memory resources that have not been properly initialized. This occurs specifically during the pre-session establishment phase, where certain data structures or buffers are referenced before being set to known safe values. The uninitialized resource access causes memory corruption or invalid pointer dereferences, resulting in the daemon crash.
Attack Vector
The attack can be executed remotely over the network without authentication. An attacker with network access to a BGP-enabled Juniper device (typically via TCP port 179) can craft and send specific BGP packets that trigger the vulnerability. The attack is effective against both internal BGP (iBGP) and external BGP (eBGP) configurations.
The attack sequence involves:
- Identifying a target Juniper device running an affected Junos OS version with BGP enabled
- Crafting specific BGP packets designed to trigger the uninitialized resource condition
- Sending these packets to the target before a valid BGP session can be established
- The rpd daemon crashes, disrupting all routing operations on the device
- Continued transmission of malicious packets maintains the DoS condition
Detection Methods for CVE-2023-28967
Indicators of Compromise
- Unexpected rpd (Routing Protocol Daemon) crashes or restarts on Juniper devices
- System logs showing rpd core dumps with memory access violations
- BGP session instability across multiple peers without apparent network issues
- Abnormal BGP OPEN or other BGP packet patterns from unexpected sources
Detection Strategies
- Monitor rpd process stability and implement alerting on unexpected daemon restarts
- Configure syslog forwarding to a SIEM and create rules for rpd crash signatures
- Implement network-based intrusion detection rules to identify malformed or suspicious BGP traffic patterns
- Review BGP session logs for connection attempts from unauthorized sources
Monitoring Recommendations
- Enable enhanced logging for BGP session establishment events
- Configure SNMP traps for rpd process state changes
- Implement real-time monitoring of BGP peer states across the infrastructure
- Deploy flow telemetry to baseline normal BGP traffic patterns and alert on anomalies
How to Mitigate CVE-2023-28967
Immediate Actions Required
- Identify all Juniper devices running affected Junos OS and Junos OS Evolved versions in your environment
- Prioritize patching of internet-facing and critical infrastructure BGP routers
- Review and restrict BGP peer configurations to authorized peers only using strict prefix filters and peer authentication
- Implement access control lists (ACLs) to limit BGP port 179 access to known, authorized BGP peers
Patch Information
Juniper Networks has released patched versions addressing this vulnerability. For Junos OS, upgrade to version 21.1R3-S5, 21.2R3-S2, 21.3R3-S2, 21.4R3, 22.1R3, 22.2R2, or later. For Junos OS Evolved, upgrade to version 21.4R3-EVO, 22.1R3-EVO, 22.2R2-EVO, or later. Detailed patch information is available in the Juniper Security Advisory JSA70591.
Workarounds
- Implement strict BGP peer authentication using MD5 or TCP-AO where supported
- Configure firewall filters to restrict BGP traffic to authorized peer IP addresses only
- Consider deploying BGP TTL security (GTSM) to limit BGP connections to directly connected peers
- Monitor and rate-limit incoming BGP connection attempts from untrusted sources
# Example: Configure firewall filter to restrict BGP access (Junos OS)
set firewall family inet filter PROTECT-BGP term ALLOW-BGP-PEERS from source-prefix-list BGP-AUTHORIZED-PEERS
set firewall family inet filter PROTECT-BGP term ALLOW-BGP-PEERS from protocol tcp
set firewall family inet filter PROTECT-BGP term ALLOW-BGP-PEERS from destination-port bgp
set firewall family inet filter PROTECT-BGP term ALLOW-BGP-PEERS then accept
set firewall family inet filter PROTECT-BGP term DENY-BGP from protocol tcp
set firewall family inet filter PROTECT-BGP term DENY-BGP from destination-port bgp
set firewall family inet filter PROTECT-BGP term DENY-BGP then discard
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
