#VU98352 Allocation of resources without limits or throttling in Junos OS Evolved - CVE-2024-47502
Published: October 10, 2024
Vulnerability identifier: #VU98352
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2024-47502
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Junos OS Evolved
Junos OS Evolved
Software vendor:
Juniper Networks, Inc.
Juniper Networks, Inc.
Description
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to allocation of resources without limits or throttling error in the kernel. A remote non-authenticated attacker can cause a Denial of Service (DoS).
In specific cases the state of TCP sessions that are terminated is not cleared, which over time leads to an exhaustion of resources, preventing new connections to the control plane from being established.
A continuously increasing number of connections shown by:user@host > show system connectionsis indicative of the problem.
Remediation
Install updates from vendor's website.