CVE-2024-30382

published 2024-04-12

CVE-2024-30382: An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a…

high 8.7 CVSS 4.0

AV N AC L AT N PR N UI N VC N VI N VA H SC N SI N SA L E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based, unauthenticated attacker to send a specific routing update, causing an rpd core due to memory corruption, leading to a Denial of Service (DoS).

This issue can only be triggered when the system is configured for CoS-based forwarding (CBF) with a policy map containing a cos-next-hop-map action (see below).
This issue affects:
Junos OS:

* all versions before 20.4R3-S10,
* from 21.2 before 21.2R3-S8,
* from 21.3 before 21.3R3,
* from 21.4 before 21.4R3,
* from 22.1 before 22.1R2;

Junos OS Evolved:

* all versions before 21.2R3-S8-EVO,
* from 21.3 before 21.3R3-EVO,
* from 21.4 before 21.4R3-EVO,
* from 22.1 before 22.1R2-EVO.

Affected

21 ranges

Vendor	Product	Version range	Fixed in
juniper	junos	< 20.4	20.4
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos_os	—	—
juniper	junos_os_evolved	< 21.2	21.2
juniper	junos_os_evolved	—	—
juniper	junos_os_evolved	—	—
juniper	junos_os_evolved	—	—
juniper	junos_os_evolved	—	—
juniper_networks	junos_os	< 20.4R3-S10	20.4R3-S10
juniper_networks	junos_os	>= 21.2 < 21.2R3-S8	21.2R3-S8
juniper_networks	junos_os	>= 21.3 < 21.3R3	21.3R3
juniper_networks	junos_os	>= 21.4 < 21.4R3	21.4R3
juniper_networks	junos_os	>= 22.1 < 22.1R2	22.1R2
juniper_networks	junos_os_evolved	< 21.2R3-S8-EVO	21.2R3-S8-EVO
juniper_networks	junos_os_evolved	>= 21.3 < 21.3R3-EVO	21.3R3-EVO
juniper_networks	junos_os_evolved	>= 21.4 < 21.4R3-EVO	21.4R3-EVO
juniper_networks	junos_os_evolved	>= 22.1 < 22.1R2-EVO	22.1R2-EVO

CWE-755