Exposure of resource to wrong sphere in Junos OS - CVE-2024-21605
Published: April 11, 2024
Vulnerability identifier: #VU88450
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-21605
CWE-ID: CWE-668
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to exposure of resource to wrong sphere error in the Packet Forwarding Engine (PFE). A remote non-authenticated attacker can cause a Denial of Service (DoS).
Specific valid link-local traffic is not blocked on ports in STP blocked state but is instead sent to the control plane of the device.
This leads to excessive resource consumption and in turn severe impact on all control and management protocols of the device.
Affected software
Junos OS
How to mitigate CVE-2024-21605
Install updates from vendor's website.
Junos OS - addressed in versions 21.2R3-S6, 22.1R3-S4, 22.2R3-S2, 22.3R3-S1, 22.4R2-S2, 22.4R3, 23.2R1-S1, 23.2R2, 23.4R1