View Bulletin PSN-2011-08-327
Title 	MX Series MPC crash in Ktree::createFourWayNode after BGP UPDATE
Products Affected 	This issue can affect any MX Series router with port 
concentrators based on the Trio chipset -- such as the MPC or embedded 
into the MX80 -- with active protocol-based route prefix 
additions/deletions occurring.
# Platforms Affected 	Security
# JUNOS 11.x
# MX-series
# JUNOS 10.x
# SIRT Security Advisory
# SIRT Security Notice
Revision Number 	2
Issue Date 	2011-08-08

PSN Issue :
MPCs (Modular Port Concentrators) installed in an MX Series router may 
crash upon receipt of very specific and unlikely route prefix 
install/delete actions, such as a BGP routing update. The set of route 
prefix updates appears to be non-deterministic. Junos versions affected 
include 10.0, 10.1, 10.2, 10.3, 10.4 prior to 10.4R6, and 11.1 prior to 
11.1R4. The trigger for the MPC crash was determined to be a valid BGP 
UPDATE received from a registered network service provider, although 
this one UPDATE was determined to not be solely responsible for the 
crashes. A complex sequence of preconditions is required to trigger this 
crash. Both IPv4 and IPv6 routing prefix updates can trigger this MPC crash.

The assertions (crash) all occurred in the code used to store routing 
information, called Ktree, on the MPC. Due to the order and mix of adds 
and deletes to the tree, certain combinations of address adds and 
deletes can corrupt the data structures within the MPC, which in turn 
can cause this line card crash. The MPC recovers and returns to service 
quickly, and without operator intervention.

This issue only affects MX Series routers with port concentrators based 
on the Trio chipset, such as the MPC or embedded into the MX80. No other 
product or platform is vulnerable to this issue.

The Juniper SIRT is not aware of any malicious exploitation of this issue.

Solution:
The Ktree code has been updated and enhanced to ensure that combinations 
and permutations of routing updates will not corrupt the state of the 
line card. Extensive testing has been performed to validate an 
exceedingly large combination and permutation of route prefix additions 
and deletions.

All Junos OS software releases built on or after 2011-08-03 have fixed 
this specific issue. Releases containing the fix specifically include: 
10.0S18, 10.2S10, 10.4R6, 11.1R4, 11.2R1, and all subsequent releases 
(i.e. all releases built after 11.2R1).

This issue is being tracked as PR 610864. While this PR may not be 
viewable by customers, it can be used as a reference when discussing the 
issue with JTAC.

KB16765 - "In which releases are vulnerabilities fixed?" describes which 
release vulnerabilities are fixed as per our End of Engineering and End 
of Life support policies.

Workarounds
No known workaround exists for this issue.

Solution Implementation:

How to obtain fixed software:
Security vulnerabilities in Junos are fixed in the next available 
Maintenance Release of each supported Junos version. In some cases, a 
Maintenance Release is not planned to be available in an appropriate 
time-frame. For these cases, Service Releases are made available in 
order to be more timely. Security Advisory and Security Notices will 
indicate which Maintenance and Service Releases contain fixes for the 
issues described. Upon request to JTAC, customers will be provided 
download instructions for a Service Release. Although Juniper does not 
provide formal Release Note documentation for a Service Release, a list 
of "PRs fixed" can be provided on request.