CVE-2024-30397: Junos OS: An invalid certificate causes a Denial of Service in the Internet Key Exchange (IKE) process
An Improper Check for Unusual or Exceptional Conditions vulnerability in the the Public Key Infrastructure daemon (pkid) of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause Denial of Service (DoS).
The pkid is responsible for the certificate verification. Upon a failed verification, the pkid uses all CPU resources and becomes unresponsive to future verification attempts. This means that all subsequent VPN negotiations depending on certificate verification will fail.
This CPU utilization of pkid can be checked using this command: root@srx> show system processes extensive | match pkid xxxxx root 103 0 846M 136M CPU1 1 569:00 100.00% pkid
This issue affects: Juniper Networks Junos OS All versions prior to 20.4R3-S10; 21.2 versions prior to 21.2R3-S7; 21.4 versions prior to 21.4R3-S5; 22.1 versions prior to 22.1R3-S4; 22.2 versions prior to 22.2R3-S3; 22.3 versions prior to 22.3R3-S1; 22.4 versions prior to 22.4R3; 23.2 versions prior to 23.2R1-S2, 23.2R2.
Other sources
An Improper Check for Unusual or Exceptional Conditions vulnerability in the the Public Key Infrastructure daemon (pkid) of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause Denial of Service (DoS).
The pkid is responsible for the certificate verification. Upon a failed verification, the pkid uses all CPU resources and becomes unresponsive to future verification attempts. This means that all subsequent VPN negotiations depending on certificate verification will fail.
This CPU utilization of pkid can be checked using this command: root@srx> show system processes extensive | match pkid xxxxx ?root ?103? 0 ?846M ?136M ?CPU1 ?1 569:00 100.00% pkid
This issue affects: Juniper Networks Junos OS All versions prior to 20.4R3-S10; 21.2 versions prior to 21.2R3-S7; 21.4 versions prior to 21.4R3-S5; 22.1 versions prior to 22.1R3-S4; 22.2 versions prior to 22.2R3-S3; 22.3 versions prior to 22.3R3-S1; 22.4 versions prior to 22.4R3; 23.2 versions prior to 23.2R1-S2, 23.2R2.
— NVD
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-30397?
CVE-2024-30397 has a severity rating that allows unauthenticated attackers to cause Denial of Service (DoS) in affected Juniper Networks Junos OS versions.
How do I fix CVE-2024-30397?
To fix CVE-2024-30397, upgrade to the latest version of Junos OS that is not impacted by this vulnerability.
What versions of Junos OS are affected by CVE-2024-30397?
CVE-2024-30397 affects multiple versions of Junos OS including but not limited to 20.4R3-S10, 21.2R3-S7, 21.4R3-S5, and 22.1R3-S4.
Can CVE-2024-30397 be exploited remotely?
Yes, CVE-2024-30397 can be exploited by an unauthenticated networked attacker, allowing them to cause a Denial of Service.
What is the impact of CVE-2024-30397 on network devices?
The impact of CVE-2024-30397 on network devices is denial of service, potentially disrupting operations and availability.