// For flags

CVE-2024-30378

Junos OS: MX Series: bbe-smgd process crash upon execution of specific CLI commands

Severity Score

6.9
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

A Use After Free vulnerability in command processing of Juniper Networks Junos OS on MX Series allows a local, authenticated attacker to cause the broadband edge service manager daemon (bbe-smgd) to crash upon execution of specific CLI commands, creating a Denial of Service (DoS) condition.  The process crashes and restarts automatically.

When specific CLI commands are executed, the bbe-smgd daemon attempts to write into an area of memory (mgd socket) that was already closed, causing the process to crash.  This process manages and controls the configuration of broadband subscriber sessions and services.  While the process is unavailable, additional subscribers will not be able to connect to the device, causing a temporary Denial of Service condition.

This issue only occurs if Graceful Routing Engine Switchover (GRES) and Subscriber Management are enabled.
This issue affects Junos OS:


* All versions before 20.4R3-S5,
* from 21.1 before 21.1R3-S4,
* from 21.2 before 21.2R3-S3,
* from 21.3 before 21.3R3-S5,
* from 21.4 before 21.4R3-S5,
* from 22.1 before 22.1R3,
* from 22.2 before 22.2R3,
* from 22.3 before 22.3R2;

Una vulnerabilidad Use After Free en el procesamiento de comandos de Juniper Networks Junos OS en la serie MX permite que un atacante local autenticado provoque que el demonio del administrador de servicios de banda ancha (bbe-smgd) se bloquee al ejecutar comandos CLI específicos, creando una condición de denegación de servicio ( DoS). El proceso falla y se reinicia automáticamente. Cuando se ejecutan comandos CLI específicos, el demonio bbe-smgd intenta escribir en un área de la memoria (socket mgd) que ya estaba cerrada, lo que provoca que el proceso falle. Este proceso gestiona y controla la configuración de las sesiones y servicios de los suscriptores de banda ancha. Mientras el proceso no esté disponible, los suscriptores adicionales no podrán conectarse al dispositivo, lo que provocará una condición temporal de denegación de servicio. Este problema solo ocurre si están habilitados Graceful Routing Engine Switchover (GRES) y Subscriber Management. Este problema afecta a Junos OS: * Todas las versiones anteriores a 20.4R3-S5, * desde 21.1 anterior a 21.1R3-S4, * desde 21.2 anterior a 21.2R3-S3, * desde 21.3 anterior a 21.3R3-S5, * desde 21.4 anterior a 21.4R3-S5 , * desde 22.1 antes de 22.1R3, * desde 22.2 antes de 22.2R3, * desde 22.3 antes de 22.3R2;

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
System
Vulnerable | Subsequent
Confidentiality
None
None
Integrity
None
None
Availability
High
Low
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-03-26 CVE Reserved
  • 2024-04-16 CVE Published
  • 2024-04-17 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-416: Use After Free
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Juniper Networks
Search vendor "Juniper Networks"
Junos OS
Search vendor "Juniper Networks" for product "Junos OS"
< 20.4R3-S5
Search vendor "Juniper Networks" for product "Junos OS" and version " < 20.4R3-S5"
en
Affected
Juniper Networks
Search vendor "Juniper Networks"
Junos OS
Search vendor "Juniper Networks" for product "Junos OS"
>= 21.1 < 21.1R3-S4
Search vendor "Juniper Networks" for product "Junos OS" and version " >= 21.1 < 21.1R3-S4"
en
Affected
Juniper Networks
Search vendor "Juniper Networks"
Junos OS
Search vendor "Juniper Networks" for product "Junos OS"
>= 21.2 < 21.2R3-S3
Search vendor "Juniper Networks" for product "Junos OS" and version " >= 21.2 < 21.2R3-S3"
en
Affected
Juniper Networks
Search vendor "Juniper Networks"
Junos OS
Search vendor "Juniper Networks" for product "Junos OS"
>= 21.3 < 21.3R3-S5
Search vendor "Juniper Networks" for product "Junos OS" and version " >= 21.3 < 21.3R3-S5"
en
Affected
Juniper Networks
Search vendor "Juniper Networks"
Junos OS
Search vendor "Juniper Networks" for product "Junos OS"
>= 21.4 < 21.4R3-S5
Search vendor "Juniper Networks" for product "Junos OS" and version " >= 21.4 < 21.4R3-S5"
en
Affected
Juniper Networks
Search vendor "Juniper Networks"
Junos OS
Search vendor "Juniper Networks" for product "Junos OS"
>= 22.1 < 22.1R3
Search vendor "Juniper Networks" for product "Junos OS" and version " >= 22.1 < 22.1R3"
en
Affected
Juniper Networks
Search vendor "Juniper Networks"
Junos OS
Search vendor "Juniper Networks" for product "Junos OS"
>= 22.2 < 22.2R3
Search vendor "Juniper Networks" for product "Junos OS" and version " >= 22.2 < 22.2R3"
en
Affected
Juniper Networks
Search vendor "Juniper Networks"
Junos OS
Search vendor "Juniper Networks" for product "Junos OS"
>= 22.3 < 22.3R2
Search vendor "Juniper Networks" for product "Junos OS" and version " >= 22.3 < 22.3R2"
en
Affected