CVE-2024-30382: Junos OS and Junos OS Evolved: RPD crash when CoS-based forwarding (CBF) policy is configured
An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based, unauthenticated attacker to send a specific routing update, causing an rpd core due to memory corruption, leading to a Denial of Service (DoS).
This issue can only be triggered when the system is configured for CoS-based forwarding (CBF) with a policy map containing a cos-next-hop-map action (see below). This issue affects: Junos OS:
all versions before 20.4R3-S10, from 21.2 before 21.2R3-S8, from 21.3 before 21.3R3, from 21.4 before 21.4R3, from 22.1 before 22.1R2;
Junos OS Evolved:
all versions before 21.2R3-S8-EVO, from 21.3 before 21.3R3-EVO, from 21.4 before 21.4R3-EVO, from 22.1 before 22.1R2-EVO.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-30382?
CVE-2024-30382 has a high severity rating due to its potential to cause memory corruption and crash the routing protocol daemon.
How do I fix CVE-2024-30382?
To fix CVE-2024-30382, you should upgrade to the latest patched version of Junos OS or Junos OS Evolved as specified by Juniper Networks.
What versions are affected by CVE-2024-30382?
CVE-2024-30382 affects Junos OS versions up to 20.4R3-S10 and Junos OS Evolved up to 21.2R3-S8-EVO.
Can CVE-2024-30382 be exploited remotely?
Yes, CVE-2024-30382 can be exploited remotely by an unauthenticated attacker via specific routing updates.
What are the potential impacts of CVE-2024-30382?
The potential impacts of CVE-2024-30382 include network disruptions and service outages due to the crashing of the routing protocol daemon.