CVE-2024-21602

A NULL Pointer Dereference vulnerability in Juniper Networks Junos OS Evolved on ACX7024, ACX7100-32C and ACX7100-48L allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). If a specific IPv4 UDP packet is received and sent to the Routing Engine (RE) packetio crashes and restarts which causes a momentary traffic interruption. Continued receipt of such packets will lead to a sustained DoS. This issue does not happen with IPv6 packets. This issue affects Juniper Networks Junos OS Evolved on ACX7024, ACX7100-32C and ACX7100-48L: * 21.4-EVO versions earlier than 21.4R3-S6-EVO; * 22.1-EVO versions earlier than 22.1R3-S5-EVO; * 22.2-EVO versions earlier than 22.2R2-S1-EVO, 22.2R3-EVO; * 22.3-EVO versions earlier than 22.3R2-EVO. This issue does not affect Juniper Networks Junos OS Evolved versions earlier than 21.4R1-EVO.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://supportportal.juniper.net/JSA75743	Vendor Advisory
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:juniper:junos_os_evolved:21.4:-::::::
	cpe:2.3:o:juniper:junos_os_evolved:21.4:r1::::::
	cpe:2.3:o:juniper:junos_os_evolved:21.4:r1-s1::::::
	cpe:2.3:o:juniper:junos_os_evolved:21.4:r1-s2::::::
	cpe:2.3:o:juniper:junos_os_evolved:21.4:r2::::::
	cpe:2.3:o:juniper:junos_os_evolved:21.4:r2-s1::::::
	cpe:2.3:o:juniper:junos_os_evolved:21.4:r2-s2::::::
	cpe:2.3:o:juniper:junos_os_evolved:21.4:r3::::::
	cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s1::::::
	cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s2::::::
	cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s3::::::
	cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s4::::::
	cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s5::::::

Configuration 2 (hide)

OR	cpe:2.3:o:juniper:junos_os_evolved:22.1:-::::::
	cpe:2.3:o:juniper:junos_os_evolved:22.1:r1::::::
	cpe:2.3:o:juniper:junos_os_evolved:22.1:r1-s1::::::
	cpe:2.3:o:juniper:junos_os_evolved:22.1:r1-s2::::::
	cpe:2.3:o:juniper:junos_os_evolved:22.1:r2::::::
	cpe:2.3:o:juniper:junos_os_evolved:22.1:r2-s1::::::
	cpe:2.3:o:juniper:junos_os_evolved:22.1:r3::::::
	cpe:2.3:o:juniper:junos_os_evolved:22.1:r3-s1::::::
	cpe:2.3:o:juniper:junos_os_evolved:22.1:r3-s2::::::
	cpe:2.3:o:juniper:junos_os_evolved:22.1:r3-s3::::::
	cpe:2.3:o:juniper:junos_os_evolved:22.1:r3-s4::::::

Configuration 3 (hide)

OR	cpe:2.3:o:juniper:junos_os_evolved:22.2:-::::::
	cpe:2.3:o:juniper:junos_os_evolved:22.2:r1::::::
	cpe:2.3:o:juniper:junos_os_evolved:22.2:r1-s1::::::
	cpe:2.3:o:juniper:junos_os_evolved:22.2:r2::::::

Configuration 4 (hide)

OR	cpe:2.3:o:juniper:junos_os_evolved:22.3:-::::::
	cpe:2.3:o:juniper:junos_os_evolved:22.3:r1::::::
	cpe:2.3:o:juniper:junos_os_evolved:22.3:r1-s1::::::
	cpe:2.3:o:juniper:junos_os_evolved:22.3:r1-s2::::::

History

No history.

Information

Published : 2024-01-12 01:15

Updated : 2024-01-19 22:55

NVD link : CVE-2024-21602

Mitre link : CVE-2024-21602

CVE.ORG link : CVE-2024-21602

JSON object : View

Products Affected

juniper

junos_os_evolved

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2024-21602", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "sirt@juniper.net", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-01-12T01:15:48.270", "references": [{"url": "https://supportportal.juniper.net/JSA75743", "tags": ["Vendor Advisory"], "source": "sirt@juniper.net"}, {"url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L", "tags": ["Third Party Advisory"], "source": "sirt@juniper.net"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}, {"type": "Secondary", "source": "sirt@juniper.net", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "\nA NULL Pointer Dereference vulnerability in Juniper Networks Junos OS Evolved on ACX7024, ACX7100-32C and ACX7100-48L allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).\n\nIf a specific IPv4 UDP packet is received and sent to the Routing Engine (RE) packetio crashes and restarts which causes a momentary traffic interruption. Continued receipt of such packets will lead to a sustained DoS.\n\nThis issue does not happen with IPv6 packets.\n\nThis issue affects Juniper Networks Junos OS Evolved on ACX7024, ACX7100-32C and ACX7100-48L:\n\n\n\n * 21.4-EVO versions earlier than 21.4R3-S6-EVO;\n * 22.1-EVO versions earlier than 22.1R3-S5-EVO;\n * 22.2-EVO versions earlier than 22.2R2-S1-EVO, 22.2R3-EVO;\n * 22.3-EVO versions earlier than 22.3R2-EVO.\n\n\n\n\nThis issue does not affect Juniper Networks Junos OS Evolved versions earlier than 21.4R1-EVO.\n\n\n\n"}, {"lang": "es", "value": "Una vulnerabilidad de desreferencia de puntero NULL en Juniper Networks Junos OS Evolved en ACX7024, ACX7100-32C y ACX7100-48L permite que un atacante no autenticado basado en red provoque una denegaci\u00f3n de servicio (DoS). Si se recibe y env\u00eda un paquete UDP IPv4 espec\u00edfico al motor de enrutamiento (RE), el paquete falla y se reinicia, lo que provoca una interrupci\u00f3n moment\u00e1nea del tr\u00e1fico. La recepci\u00f3n continua de dichos paquetes dar\u00e1 lugar a una DoS sostenida. Este problema no ocurre con los paquetes IPv6. Este problema afecta a Juniper Networks Junos OS Evolved en ACX7024, ACX7100-32C y ACX7100-48L: * Versiones 21.4-EVO anteriores a 21.4R3-S6-EVO; * Versiones 22.1-EVO anteriores a 22.1R3-S5-EVO; * Versiones 22.2-EVO anteriores a 22.2R2-S1-EVO, 22.2R3-EVO; * Versiones 22.3-EVO anteriores a 22.3R2-EVO. Este problema no afecta a las versiones evolucionadas de Juniper Networks Junos OS anteriores a 21.4R1-EVO."}], "lastModified": "2024-01-19T22:55:48.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.4:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E907193-075E-45BC-9257-9607DB790D71"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.4:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B73A41D-3FF5-4E53-83FF-74DF58E0D6C3"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.4:r1-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEDF46A8-FC3A-4779-B695-2CA11D045AEB"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.4:r1-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39809219-9F87-4583-9DAD-9415DD320B36"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.4:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB299492-A919-4EBA-A62A-B3CF02FC0A95"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.4:r2-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74ED0939-D5F8-4334-9838-40F29DE3597F"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.4:r2-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6937069-8C19-4B01-8415-ED7E9EAE2CE2"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.4:r3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97DB6DD5-F5DD-4AE1-AF2F-8DB9E18FF882"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21DF05B8-EF7E-422F-8831-06904160714C"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "492FCE45-68A1-4378-85D4-C4034FE0D836"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "522114CC-1505-4205-B4B8-797DE1BD833B"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9D664AB-0FA7-49C7-B6E1-69C77652FBEF"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9DB01252-2F11-41DB-9023-C74FD723334E"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C16434C0-21A7-4CE5-92E1-7D60A35EF5D1"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.1:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "750FE748-82E7-4419-A061-2DEA26E35309"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.1:r1-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "236E23E5-8B04-4081-9D97-7300DF284000"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.1:r1-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5FC96EA7-90A7-4838-B95D-60DBC88C7BC7"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.1:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97541867-C52F-40BB-9AAE-7E87ED23D789"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.1:r2-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85CF6664-E35A-4E9B-95C0-CDC91F7F331A"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.1:r3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E048A05D-882F-4B1C-BA32-3BBA3FEA31A3"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.1:r3-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47E8D51D-1424-4B07-B036-E3E195F21AC2"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.1:r3-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F3C82ED-5728-406F-ACF6-D7411B0AB6C0"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.1:r3-s3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1475A58F-1515-4492-B5A3-BE40C30E5B14"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.1:r3-s4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C9C133A-6114-495F-872C-BD1200953131"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.2:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3CA3365-F9AF-40DF-8700-30AD4BC58E27"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.2:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D77A072D-350A-42F2-8324-7D3AC1711BF9"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.2:r1-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83AE395C-A651-4568-88E3-3600544BF799"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.2:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3BE1FD4-DAD9-4357-A2E9-20E5826B0D5C"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.3:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE2EF84D-55A9-41DC-A324-69E1DC426D0B"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.3:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "433631CA-3AC4-4D66-9B46-AEA4209347F1"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.3:r1-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E4CD8AD-277A-4FC5-A102-3E151060C216"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.3:r1-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BC09BAC-83E7-48CE-B571-ED49277B2987"}], "operator": "OR"}]}], "sourceIdentifier": "sirt@juniper.net"}

7.5 /10