Page MenuHomePhabricator

Juniper RA receive bug CVE-2023-28981
Closed, ResolvedPublic

Description

The following security advisory has been announced by Juniper:

2023-04 Security Bulletin: Junos OS and Junos OS Evolved: If malformed IPv6 router advertisements are received, memory corruption will occur which causes an rpd crash (CVE-2023-28981)
https://supportportal.juniper.net/s/article/2023-04-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-If-malformed-IPv6-router-advertisements-are-received-memory-corruption-will-occur-which-causes-an-rpd-crash-CVE-2023-28981?language=en_US

Our L3 switches and CR routers are potentially affected. The good news is only on our internal-interfaces towards our own servers, as only they have router-advertisements enabled. Still we may want to consider adding the mitigation Juniper suggest:

set firewall family inet6 filter test term 1 from next-header icmp6
set firewall family inet6 filter test term 1 from icmp-type 134
set firewall family inet6 filter test term 1 then discard
set firewall family inet6 filter test term 2 then accept

I'm not sure the risk is high enough to warrant a full upgrade cycle on the CRs.

Details

Event Timeline

cmooney triaged this task as Low priority.

Change 959732 had a related patch set uploaded (by Ayounsi; author: Ayounsi):

[operations/homer/public@master] Block inbound RAs on the routers

https://gerrit.wikimedia.org/r/959732

Change 959732 merged by jenkins-bot:

[operations/homer/public@master] Block inbound RAs on the routers

https://gerrit.wikimedia.org/r/959732

Mentioned in SAL (#wikimedia-operations) [2023-09-25T07:06:10Z] <XioNoX> roll out "Block inbound RAs on the routers" - T334916

ayounsi claimed this task.

Deployed

This might need to be rolled back the day we start doing BGP unnumbered between spine and leaf as it seems to rely on it: https://www.theasciiconstruct.com/post/junos-bgp-and-bgp-unnumbered/#ipv6-configuration-for-bgp-unnumbered

Hmm yeah good point. We can probably upgrade devices to a release with the fix in it before then.