CVE-2016-10142 in Junos
Summary
by MITRE
An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages. (The scope of this CVE is all affected IPv6 implementations from all vendors.) The security implications of IP fragmentation have been discussed at length in [RFC6274] and [RFC7739]. An attacker can leverage the generation of IPv6 atomic fragments to trigger the use of fragmentation in an arbitrary IPv6 flow (in scenarios in which actual fragmentation of packets is not needed) and can subsequently perform any type of fragmentation-based attack against legacy IPv6 nodes that do not implement [RFC6946]. That is, employing fragmentation where not actually needed allows for fragmentation-based attack vectors to be employed, unnecessarily. We note that, unfortunately, even nodes that already implement [RFC6946] can be subject to DoS attacks as a result of the generation of IPv6 atomic fragments. Let us assume that Host A is communicating with Host B and that, as a result of the widespread dropping of IPv6 packets that contain extension headers (including fragmentation) [RFC7872], some intermediate node filters fragments between Host B and Host A. If an attacker sends a forged ICMPv6 PTB error message to Host B, reporting an MTU smaller than 1280, this will trigger the generation of IPv6 atomic fragments from that moment on (as required by [RFC2460]). When Host B starts sending IPv6 atomic fragments (in response to the received ICMPv6 PTB error message), these packets will be dropped, since we previously noted that IPv6 packets with extension headers were being dropped between Host B and Host A. Thus, this situation will result in a DoS scenario. Another possible scenario is that in which two BGP peers are employing IPv6 transport and they implement Access Control Lists (ACLs) to drop IPv6 fragments (to avoid control-plane attacks). If the aforementioned BGP peers drop IPv6 fragments but still honor received ICMPv6 PTB error messages, an attacker could easily attack the corresponding peering session by simply sending an ICMPv6 PTB message with a reported MTU smaller than 1280 bytes. Once the attack packet has been sent, the aforementioned routers will themselves be the ones dropping their own traffic.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/13/2026
The vulnerability described in CVE-2016-10142 represents a critical flaw in IPv6 protocol implementation that exploits the interaction between ICMP Packet Too Big (PTB) messages and IPv6 fragmentation mechanisms. This issue affects all IPv6 implementations across vendors and stems from the improper handling of IPv6 atomic fragments, which are packets that cannot be fragmented due to their size or the presence of extension headers. The vulnerability specifically targets the behavior of IPv6 nodes when processing ICMPv6 PTB error messages, creating conditions where legitimate network traffic can be disrupted through carefully crafted malicious packets. The security implications extend beyond simple packet dropping to encompass potential denial-of-service scenarios that can compromise network connectivity and availability.
The technical flaw resides in how IPv6 implementations respond to ICMPv6 PTB messages when the reported MTU is below the minimum IPv6 MTU of 1280 bytes. According to RFC2460, when an IPv6 node receives such a message, it must generate IPv6 atomic fragments for subsequent packets in that flow. This mechanism was designed to prevent fragmentation issues, but attackers can exploit it by sending forged PTB messages with artificially low MTU values. The vulnerability becomes particularly dangerous when combined with existing network filtering practices, such as those described in RFC7872 where intermediate nodes drop IPv6 packets containing extension headers. When an attacker triggers this scenario, the legitimate communication path becomes disrupted because the generated atomic fragments are dropped by network infrastructure, creating a cascading denial-of-service condition.
The operational impact of this vulnerability manifests in multiple attack vectors that can be leveraged against various network components including end hosts, intermediate routers, and BGP peers. Network administrators face significant challenges because the attack can be executed without requiring deep network knowledge or specialized tools, making it particularly dangerous in production environments. The vulnerability affects implementations that do not properly adhere to RFC6946, which provides guidelines for handling IPv6 fragmentation in the presence of extension headers. Even systems that do implement RFC6946 remain vulnerable due to the fundamental flaw in how they process PTB messages and generate atomic fragments. This creates a scenario where network operators must balance security requirements with operational continuity, as the defensive measures against fragmentation-based attacks can inadvertently create new attack surfaces.
Mitigation strategies for CVE-2016-10142 require implementing robust validation of ICMPv6 PTB messages and establishing proper filtering mechanisms at network boundaries. Organizations should ensure that IPv6 implementations properly validate MTU values in received PTB messages and reject those that are below acceptable thresholds, typically the minimum IPv6 MTU of 1280 bytes. Network infrastructure should be configured to properly handle fragmentation scenarios without creating unintended attack vectors, including implementing appropriate access control lists that do not inadvertently drop legitimate atomic fragments. Security measures should also include monitoring for unusual PTB message patterns and implementing rate limiting to prevent flood attacks. The vulnerability aligns with ATT&CK technique T1499.001 for network denial of service attacks and CWE-129 for improper validation of input boundaries. Network administrators must also consider implementing comprehensive testing procedures to verify that their IPv6 implementations properly handle edge cases in PTB message processing, ensuring that the security model does not inadvertently create new vulnerabilities while addressing existing ones.
This vulnerability demonstrates the complex interdependencies between network protocols and the potential for seemingly benign features to become security risks when combined with existing network filtering practices. The attack vectors exposed by CVE-2016-10142 highlight the importance of considering the full attack surface when implementing network security measures, particularly in IPv6 environments where fragmentation handling can create unexpected security implications. The issue also underscores the need for continuous protocol validation and the importance of adhering to established RFC standards while maintaining awareness of potential interactions between different protocol features. Organizations must recognize that network security is not merely about preventing known attacks but also about understanding how different protocol elements interact to create new vulnerabilities. The remediation efforts should focus on implementing proper message validation, maintaining consistent network behavior across all nodes, and ensuring that security measures do not create new attack surfaces through their implementation.