Resource exhaustion in Juniper Junos
CVE-2018-0063
A vulnerability in the IP next-hop index database in Junos OS 17.3R3 may allow a flood of ARP requests, sent to the management interface, to exhaust the private Internal routing interfaces (IRIs) next-hop limit. Once the IRI next-hop database is full, no further next hops can be learned and existing entries cannot be cleared, leading to a sustained denial of service (DoS) condition. An indicator of compromise for this issue is the report of the following error message: %KERN-4: Nexthop index allocation failed: private index space exhausted This issue only affects the management interface, and does not impact regular transit traffic through the FPCs. This issue also only affects Junos OS 17.3R3. No prior versions of Junos OS are affected by this issue. Affected releases are Juniper Networks Junos OS: 17.3R3.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.006 (48.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 48.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Juniper Junos — versions 17.3
- Juniper Networks Junos OS — versions 17.3R3
Weakness classification (CWE)
References
- www.securitytracker.com/id/1041861 (VDB Entry, Third Party Advisory, vdb-entry)
- kb.juniper.net/JSA10899 (Vendor Advisory)
Frequently asked questions
- What is CVE-2018-0063?
- CVE-2018-0063 is a medium-severity vulnerability in Juniper Junos, classified under Uncontrolled Resource Consumption. CVSS score: 6.5/10. Published 2018-10-10.
- How severe is CVE-2018-0063?
- Medium severity. CVSS v3 base score is 6.5 out of 10.