CVE-2024-21594

Junos OS: SRX 5000 Series: Repeated execution of a specific CLI command causes a flowd crash

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A Heap-based Buffer Overflow vulnerability in the Network Services Daemon (NSD) of Juniper Networks Junos OS allows authenticated, low privileged, local attacker to cause a Denial of Service (DoS).

On an SRX 5000 Series device, when executing a specific command repeatedly, memory is corrupted, which leads to a Flow Processing Daemon (flowd) crash.

The NSD process has to be restarted to restore services.

If this issue occurs, it can be checked with the following command:

user@host> request security policies check
The following log message can also be observed:

Error: policies are out of sync for PFE node<number>.fpc<number>.pic<number>.
This issue affects:

Juniper Networks Junos OS on SRX 5000 Series

* All versions earlier than 20.4R3-S6;
* 21.1 versions earlier than 21.1R3-S5;
* 21.2 versions earlier than 21.2R3-S4;
* 21.3 versions earlier than 21.3R3-S3;
* 21.4 versions earlier than 21.4R3-S3;
* 22.1 versions earlier than 22.1R3-S1;
* 22.2 versions earlier than 22.2R3;
* 22.3 versions earlier than 22.3R2.

Una vulnerabilidad de desbordamiento de búfer en la región Heap de la memoria en el Network Services Daemon (NSD) de Juniper Networks Junos OS permite que un atacante local autenticado y con pocos privilegios provoque una denegación de servicio (DoS). En un dispositivo de la serie SRX 5000, al ejecutar un comando específico repetidamente, la memoria se daña, lo que provoca un bloqueo del Flow Processing Daemon (flowd). El proceso NSD debe reiniciarse para restaurar los servicios. Si ocurre este problema, se puede verificar con el siguiente comando: usuario@host> solicitar políticas de seguridad verificar También se puede observar el siguiente mensaje de registro: Error: policies are out of sync for PFE node.fpc.pic. Este problema afecta a: Juniper Networks Junos OS en la serie SRX 5000 * Todas las versiones anteriores a 20.4R3-S6; * Versiones 21.1 anteriores a 21.1R3-S5; * Versiones 21.2 anteriores a 21.2R3-S4; * Versiones 21.3 anteriores a 21.3R3-S3; * Versiones 21.4 anteriores a 21.4R3-S3; * Versiones 22.1 anteriores a 22.1R3-S1; * Versiones 22.2 anteriores a 22.2R3; * Versiones 22.3 anteriores a 22.3R2.

*Credits: N/A

CVSS Scores

NISTv3.1 5.5

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-12-27 CVE Reserved
2024-01-12 CVE Published
2024-01-19 EPSS Updated
2024-08-01 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-122: Heap-based Buffer Overflow
CWE-787: Out-of-bounds Write

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://supportportal.juniper.net/JSA75733	2024-01-18
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	2024-01-18

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				< 20.4 Search vendor "Juniper" for product "Junos" and version " < 20.4"		-		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		-		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		r1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		r1-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		r2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		r2-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		r2-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		r3		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		r3-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		r3-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		r3-s3		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		r3-s4		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		r3-s5		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.1 Search vendor "Juniper" for product "Junos" and version "21.1"		-		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.1 Search vendor "Juniper" for product "Junos" and version "21.1"		r1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.1 Search vendor "Juniper" for product "Junos" and version "21.1"		r1-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.1 Search vendor "Juniper" for product "Junos" and version "21.1"		r2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.1 Search vendor "Juniper" for product "Junos" and version "21.1"		r2-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.1 Search vendor "Juniper" for product "Junos" and version "21.1"		r2-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.1 Search vendor "Juniper" for product "Junos" and version "21.1"		r3		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.1 Search vendor "Juniper" for product "Junos" and version "21.1"		r3-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.1 Search vendor "Juniper" for product "Junos" and version "21.1"		r3-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.1 Search vendor "Juniper" for product "Junos" and version "21.1"		r3-s3		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.1 Search vendor "Juniper" for product "Junos" and version "21.1"		r3-s4		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.2 Search vendor "Juniper" for product "Junos" and version "21.2"		-		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.2 Search vendor "Juniper" for product "Junos" and version "21.2"		r1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.2 Search vendor "Juniper" for product "Junos" and version "21.2"		r1-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.2 Search vendor "Juniper" for product "Junos" and version "21.2"		r1-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.2 Search vendor "Juniper" for product "Junos" and version "21.2"		r2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.2 Search vendor "Juniper" for product "Junos" and version "21.2"		r2-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.2 Search vendor "Juniper" for product "Junos" and version "21.2"		r2-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.2 Search vendor "Juniper" for product "Junos" and version "21.2"		r3		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.2 Search vendor "Juniper" for product "Junos" and version "21.2"		r3-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.2 Search vendor "Juniper" for product "Junos" and version "21.2"		r3-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.2 Search vendor "Juniper" for product "Junos" and version "21.2"		r3-s3		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.3 Search vendor "Juniper" for product "Junos" and version "21.3"		-		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.3 Search vendor "Juniper" for product "Junos" and version "21.3"		r1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.3 Search vendor "Juniper" for product "Junos" and version "21.3"		r1-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.3 Search vendor "Juniper" for product "Junos" and version "21.3"		r1-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.3 Search vendor "Juniper" for product "Junos" and version "21.3"		r2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.3 Search vendor "Juniper" for product "Junos" and version "21.3"		r2-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.3 Search vendor "Juniper" for product "Junos" and version "21.3"		r2-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.3 Search vendor "Juniper" for product "Junos" and version "21.3"		r3		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.3 Search vendor "Juniper" for product "Junos" and version "21.3"		r3-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.3 Search vendor "Juniper" for product "Junos" and version "21.3"		r3-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.4 Search vendor "Juniper" for product "Junos" and version "21.4"		-		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.4 Search vendor "Juniper" for product "Junos" and version "21.4"		r1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.4 Search vendor "Juniper" for product "Junos" and version "21.4"		r1-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.4 Search vendor "Juniper" for product "Junos" and version "21.4"		r1-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.4 Search vendor "Juniper" for product "Junos" and version "21.4"		r2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.4 Search vendor "Juniper" for product "Junos" and version "21.4"		r2-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.4 Search vendor "Juniper" for product "Junos" and version "21.4"		r2-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.4 Search vendor "Juniper" for product "Junos" and version "21.4"		r3		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.4 Search vendor "Juniper" for product "Junos" and version "21.4"		r3-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.4 Search vendor "Juniper" for product "Junos" and version "21.4"		r3-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.1 Search vendor "Juniper" for product "Junos" and version "22.1"		-		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.1 Search vendor "Juniper" for product "Junos" and version "22.1"		r1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.1 Search vendor "Juniper" for product "Junos" and version "22.1"		r1-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.1 Search vendor "Juniper" for product "Junos" and version "22.1"		r1-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.1 Search vendor "Juniper" for product "Junos" and version "22.1"		r2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.1 Search vendor "Juniper" for product "Junos" and version "22.1"		r2-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.1 Search vendor "Juniper" for product "Junos" and version "22.1"		r2-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.1 Search vendor "Juniper" for product "Junos" and version "22.1"		r3		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.2 Search vendor "Juniper" for product "Junos" and version "22.2"		-		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.2 Search vendor "Juniper" for product "Junos" and version "22.2"		r1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.2 Search vendor "Juniper" for product "Junos" and version "22.2"		r1-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.2 Search vendor "Juniper" for product "Junos" and version "22.2"		r1-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.2 Search vendor "Juniper" for product "Junos" and version "22.2"		r2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.2 Search vendor "Juniper" for product "Junos" and version "22.2"		r2-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.2 Search vendor "Juniper" for product "Junos" and version "22.2"		r2-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.3 Search vendor "Juniper" for product "Junos" and version "22.3"		-		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.3 Search vendor "Juniper" for product "Junos" and version "22.3"		r1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.3 Search vendor "Juniper" for product "Junos" and version "22.3"		r1-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				22.3 Search vendor "Juniper" for product "Junos" and version "22.3"		r1-s2		Affected