Log in Start free

Vulnerability · Published Apr 12, 2024 · Assigned by juniper

CVE-2024-30382Junos OS and Junos OS Evolved: RPD crash when CoS-based forwarding (CBF) policy is configured

High 7.5

In plain English

A high-severity security flaw in Junos OS from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 46.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based, unauthenticated attacker to send a specific routing update, causing an rpd core due to memory corruption, leading to a Denial of Service (DoS). This issue can only be triggered when the system is configured for CoS-based forwarding (CBF) with a policy map containing a cos-next-hop-map action (see below). This issue affects: Junos OS: * all versions before 20.4R3-S10, * from 21.2 before 21.2R3-S8, * from 21.3 before 21.3R3, * from 21.4 before 21.4R3, * from 22.1 before 22.1R2; Junos OS Evolved: * all versions before 21.2R3-S8-EVO, * from 21.3 before 21.3R3-EVO, * from 21.4 before 21.4R3-EVO, * from 22.1 before 22.1R2-EVO.

Affected products (as reported)

VendorProductVersions
Juniper Networks Junos OS 0 – before 20.4R3-S1021.2 – before 21.2R3-S821.3 – before 21.3R321.4 – before 21.4R322.1 – before 22.1R2
Juniper Networks Junos OS Evolved 0 – before 21.2R3-S8-EVO21.3 – before 21.3R3-EVO21.4 – before 21.4R3-EVO22.1 – before 22.1R2-EVO

Weakness: CWE-755 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References