CVE-2024-47502

Junos OS Evolved: TCP session state is not always cleared on the Routing Engine leading to DoS

Severity Score

8.7

*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS).

In specific cases the state of TCP sessions that are terminated is not cleared, which over time leads to an exhaustion of resources, preventing new connections to the control plane from being established.

A continuously increasing number of connections shown by:

user@host > show system connections

is indicative of the problem. To recover the respective RE needs to be restarted manually.

This issue only affects IPv4 but does not affect IPv6.
This issue only affects TCP sessions established in-band (over an interface on an FPC) but not out-of-band (over the management ethernet port on the routing-engine).

This issue affects Junos OS Evolved:

* All versions before 21.4R3-S9-EVO,
* 22.2 versions before 22.2R3-S4-EVO,
* 22.4 version before 22.4R3-S3-EVO,
* 23.2 versions before 23.2R2-S1-EVO,
* 23.4 versions before 23.4R2-EVO.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

System

Vulnerable | Subsequent

Confidentiality

None

Integrity

None

Availability

High

Low

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

System

Vulnerable | Subsequent

Confidentiality

None

Integrity

None

Availability

High

Low

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-09-25 CVE Reserved
2024-10-11 CVE Published
2024-10-11 CVE Updated
2024-10-12 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-770: Allocation of Resources Without Limits or Throttling

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://supportportal.juniper.net/JSA88132	2024-10-11

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Juniper Networks Search vendor "Juniper Networks"		Junos OS Evolved Search vendor "Juniper Networks" for product "Junos OS Evolved"				< 21.4R3-S9-EVO Search vendor "Juniper Networks" for product "Junos OS Evolved" and version " < 21.4R3-S9-EVO"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Evolved Search vendor "Juniper Networks" for product "Junos OS Evolved"				>= 22.2 < 22.2R3-S4-EVO Search vendor "Juniper Networks" for product "Junos OS Evolved" and version " >= 22.2 < 22.2R3-S4-EVO"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Evolved Search vendor "Juniper Networks" for product "Junos OS Evolved"				>= 22.4 < 22.4R3-S3-EVO Search vendor "Juniper Networks" for product "Junos OS Evolved" and version " >= 22.4 < 22.4R3-S3-EVO"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Evolved Search vendor "Juniper Networks" for product "Junos OS Evolved"				>= 23.2 < 23.2R2-S1-EVO Search vendor "Juniper Networks" for product "Junos OS Evolved" and version " >= 23.2 < 23.2R2-S1-EVO"		en		Affected
Juniper Networks Search vendor "Juniper Networks"		Junos OS Evolved Search vendor "Juniper Networks" for product "Junos OS Evolved"				>= 23.4 < 23.4R2-EVO Search vendor "Juniper Networks" for product "Junos OS Evolved" and version " >= 23.4 < 23.4R2-EVO"		en		Affected