Junos OS: SRX Series: Due to an error in processing TCP events flowd will crash (Juniper Networks Junos OS)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.45 % · percentile 39 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- juniper
- NVD status
- Modified
Description
A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the Flow-processing Daemon (flowd) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (Dos). On SRX Series devices when two different threads try to simultaneously process a queue which is used for TCP events flowd will crash. One of these threads can not be triggered externally, so the exploitation of this race condition is outside the attackers direct control. Continued exploitation of this issue will lead to a sustained DoS. This issue affects Juniper Networks Junos OS: * 21.2 versions earlier than 21.2R3-S5; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S4; * 22.1 versions earlier than 22.1R3-S3; * 22.2 versions earlier than 22.2R3-S1; * 22.3 versions earlier than 22.3R2-S2, 22.3R3; * 22.4 versions earlier than 22.4R2-S1, 22.4R3. This issue does not affect Juniper Networks Junos OS versions earlier than 21.2R1.
Weaknesses (CWE)
- CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | juniper |
| CVSS 3.1 | MEDIUM 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · sirt@juniper.net (Secondary) |
| CVSS 3.1 | MEDIUM 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-19249
- GCVE · GCVE-0-2024-21601
CERT-FR advisories
- CERTFR-2024-AVI-0027 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.2:r1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.2:r1-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.2:r1-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.2:r2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.2:r2-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.2:r2-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.2:r3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.2:r3-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.2:r3-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.2:r3-s3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.2:r3-s4:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.3:-:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.3:r1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.3:r1-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.3:r1-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.3:r2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.3:r2-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.3:r2-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.3:r3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.3:r3-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.3:r3-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.3:r3-s3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.3:r3-s4:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.4:-:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.4:r1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.4:r1-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.4:r1-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.4:r2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.4:r2-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.4:r2-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.4:r3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.4:r3-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.4:r3-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:21.4:r3-s3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.1:-:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.1:r1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.1:r1-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.1:r1-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.1:r2:*:*:*:*:*:*- +24 more
Affected products
| Product | Versions |
|---|---|
| Juniper Networks · Junos OS | affected 21.2 < 21.2R3-S5 ; affected 21.3 < 21.3R3-S5 ; affected 21.4 < 21.4R3-S4 ; affected 22.1 < 22.1R3-S3 ; affected 22.2 < 22.2R3-S1 ; affected 22.3 < 22.3R2-S2, 22.3R3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |