#VU85279 Exposure of resource to wrong sphere in Juniper Junos OS - CVE-2024-21597

Vulnerability identifier: #VU85279

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21597

CWE-ID: CWE-668

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Juniper Junos OS
Operating systems & Components / Operating system

Vendor: Juniper Networks, Inc.

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to exposure of resource to wrong sphere error in the Packet Forwarding Engine (PFE). A remote non-authenticated attacker can bypass the intended access restrictions.

In an Abstracted Fabric (AF) scenario if routing-instances (RI) are configured, specific valid traffic destined to the device can bypass the configured lo0 firewall filters as it's received in the wrong RI context.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Juniper Junos OS: 20.4R1-S1 - 20.4R3-S8, 21.2R1-S1 - 21.2R3-S2, 21.4R1-S1 - 21.4R3-S4, 22.1R1-S1 - 22.1R3-S4, 22.2R1-S1 - 22.2R3-S3, 22.3R1-S1 - 22.3R2-S2, 22.4R1-S1 - 22.4R1-S2

---

External links
https://supportportal.juniper.net/s/article/2024-01-Security-Bulletin-Junos-OS-MX-Series-In-an-AF-scenario-traffic-can-bypass-configured-lo0-firewall-filters-CVE-2024-21597

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.