CVE-2024-39528 — Use After Free in Networks Junos OS

CWE-416 — Use After Free4 documents4 sources
Severity
6.0MEDIUMNVD
EPSS
0.4%
top 38.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Juniper Networks Junos OSJuniper Networks Junos OS EvolvedJuniper Junos+1 more
Timeline
PublishedJul 11

Description

A Use After Free vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to cause a Denial of Service (DoS).On all Junos OS and Junos Evolved platforms, if a routing-instance deactivation is triggered, and at the same time a specific SNMP request is received, a segmentation fault occurs which causes rpd to crash and restart. This issue affects: Junos OS: * All versions before 21.2R3-S8, * 21.4 versi…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Affected Packages4 packages

▶CVEListV5juniper_networks/junos_os_evolved21.4-EVO — 21.4R3-S5-EVO+5
▶CVEListV5juniper_networks/junos_os21.4 — 21.4R3-S5+5
▶NVDjuniper/junos< 21.2+6

🔴Vulnerability Details

2
CVEList
Junos OS and Junos OS Evolved: Concurrent deletion of a routing-instance and receipt of an SNMP request cause an RPD crash↗2024-07-11
▶
GHSA
GHSA-2pf5-j72f-jhxp: A Use After Free vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network↗2024-07-11
▶

📋Vendor Advisories

1
Juniper
CVE-2024-39528: A Use After Free vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network↗2024-07-11
▶
CVE-2024-39528 — Use After Free in Networks Junos OS | cvebase