CVE-2021-0271 Memory corruption in Junos OS

Medium 6.5 Published 22 Apr 2021 Updated 16 Sep 2024

An adjacent attacker can cause a denial of service on Juniper EX Series switches by sending crafted ARP packets that trigger a double free in the sfid process.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-0271?

CVE-2021-0271 is a medium-severity memory corruption vulnerability in Juniper Junos, published on 22 Apr 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A Double Free vulnerability in the software forwarding interface daemon (sfid) process of Juniper Networks Junos OS allows an adjacently-connected attacker to cause a Denial of Service (DoS) by sending a crafted ARP packet to the device. Continued receipt and processing of the crafted ARP packets will create a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS on EX2200-C Series, EX3200 Series, EX3300 Series, EX4200 Series, EX4500 Series, EX4550 Series, EX6210 Series, EX8208 Series, EX8216 Series. 12.3 versions prior to 12.3R12-S17; 15.1 versions prior to 15.1R7-S8. This issue only affects the listed Marvell-chipset based EX Series devices. No other products or platforms are affected.

Weakness: CWE-415

Which versions are affected by CVE-2021-0271?

It affects 1 product.

Products include Juniper Junos.

How do I fix CVE-2021-0271?

No fix has been published for CVE-2021-0271 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-0271 being exploited?

There is no known exploitation of CVE-2021-0271 in the wild and no public exploit code.

All Juniper Junos vulnerabilities

Sources

Also known as GHSA-pmcr-6r2h-238j.