CVE-2024-30378
Assigner: juniper
Published: 2024-04-16T20:03:56.292Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: MX Series
product: Junos OS
vendor: Juniper Networks
versions: lessThan: 20.4R3-S5
status: affected
version: 0
versionType: semver
lessThan: 21.1R3-S4
status: affected
version: 21.1
versionType: semver
lessThan: 21.2R3-S3
status: affected
version: 21.2
versionType: semver
lessThan: 21.3R3-S5
status: affected
version: 21.3
versionType: semver
lessThan: 21.4R3-S5
status: affected
version: 21.4
versionType: semver
lessThan: 22.1R3
status: affected
version: 22.1
versionType: semver
lessThan: 22.2R3
status: affected
version: 22.2
versionType: semver
lessThan: 22.3R2
status: affected
version: 22.3
versionType: semver
configurations: supportingMedia: base64: no
type: text/html
value: Subscriber Services (Broadband Edge) and GRES must be enabled to be vulnerable to this issue:<br> <br> <tt>[edit system services]<br>subscriber-management enable; <br><br> [edit chassis redundancy]<br>graceful-switchover;</tt>
value: Subscriber Services (Broadband Edge) and GRES must be enabled to be vulnerable to this issue:
 
 [edit system services]
subscriber-management enable; 

 [edit chassis redundancy]
graceful-switchover;
datePublic: 2024-04-10T16:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: A Use After Free vulnerability in command processing of Juniper Networks Junos OS on MX Series allows a local, authenticated attacker to cause the broadband edge service manager daemon (bbe-smgd) to crash upon execution of specific CLI commands, creating a Denial of Service (DoS) condition.&nbsp; The process crashes and restarts automatically.<br><br>When specific CLI commands are executed, the bbe-smgd daemon attempts to write into an area of memory (mgd socket) that was already closed, causing the process to crash.&nbsp; This process manages and controls the configuration of broadband subscriber sessions and services.&nbsp; While the process is unavailable, additional subscribers will not be able to connect to the device, causing a temporary Denial of Service condition.<br><br>This issue only occurs if&nbsp;Graceful Routing Engine Switchover (GRES) and Subscriber Management are enabled.<br><p>This issue affects Junos OS:<br></p><ul><li>All versions before 20.4R3-S5, </li><li>from 21.1 before 21.1R3-S4, </li><li>from 21.2 before 21.2R3-S3, </li><li>from 21.3 before 21.3R3-S5, </li><li>from 21.4 before 21.4R3-S5, </li><li>from 22.1 before 22.1R3, </li><li>from 22.2 before 22.2R3, </li><li>from 22.3 before 22.3R2;</li></ul><p></p><p><br></p><p></p>
value: A Use After Free vulnerability in command processing of Juniper Networks Junos OS on MX Series allows a local, authenticated attacker to cause the broadband edge service manager daemon (bbe-smgd) to crash upon execution of specific CLI commands, creating a Denial of Service (DoS) condition.  The process crashes and restarts automatically.

When specific CLI commands are executed, the bbe-smgd daemon attempts to write into an area of memory (mgd socket) that was already closed, causing the process to crash.  This process manages and controls the configuration of broadband subscriber sessions and services.  While the process is unavailable, additional subscribers will not be able to connect to the device, causing a temporary Denial of Service condition.

This issue only occurs if Graceful Routing Engine Switchover (GRES) and Subscriber Management are enabled.
This issue affects Junos OS:


  *  All versions before 20.4R3-S5, 
  *  from 21.1 before 21.1R3-S4, 
  *  from 21.2 before 21.2R3-S3, 
  *  from 21.3 before 21.3R3-S5, 
  *  from 21.4 before 21.4R3-S5, 
  *  from 22.1 before 22.1R3, 
  *  from 22.2 before 22.2R3, 
  *  from 22.3 before 22.3R2;
exploits: supportingMedia: base64: no
type: text/html
value: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
value: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
cvssV4_0: Automatable: NOT_DEFINED
Recovery: NOT_DEFINED
Safety: NOT_DEFINED
attackComplexity: LOW
attackRequirements: NONE
attackVector: LOCAL
baseScore: 6.9
baseSeverity: MEDIUM
privilegesRequired: NONE
providerUrgency: NOT_DEFINED
subAvailabilityImpact: LOW
subConfidentialityImpact: NONE
subIntegrityImpact: NONE
userInteraction: NONE
valueDensity: NOT_DEFINED
vectorString: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
version: 4.0
vulnAvailabilityImpact: HIGH
vulnConfidentialityImpact: NONE
vulnIntegrityImpact: NONE
vulnerabilityResponseEffort: NOT_DEFINED
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-416
description: CWE-416 Use After Free
type: CWE
descriptions: description: Denial of Service (DoS)
solutions: supportingMedia: base64: no
type: text/html
value: The following software releases have been updated to resolve this specific issue: Junos OS: 20.4R3-S5, 21.1R3-S4, 21.2R3-S3, 21.3R3-S5, 21.4R3-S5, 22.1R3, 22.2R3, 22.3R2, 22.4R1, and all subsequent releases.<br>
value: The following software releases have been updated to resolve this specific issue: Junos OS: 20.4R3-S5, 21.1R3-S4, 21.2R3-S3, 21.3R3-S5, 21.4R3-S5, 22.1R3, 22.2R3, 22.3R2, 22.4R1, and all subsequent releases.
source: advisory: JSA79109
defect: 1688750
discovery: INTERNAL
title: Junos OS: MX Series: bbe-smgd process crash upon execution of specific CLI commands
workarounds: supportingMedia: base64: no
type: text/html
value: <p>Use access lists or firewall filters to limit access to the CLI only from trusted hosts and administrators.</p>
value: Use access lists or firewall filters to limit access to the CLI only from trusted hosts and administrators.
x_generator: engine: Vulnogram 0.1.0-dev