CVE-2024-47508

Summary

An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an authenticated, network-based attacker to cause an FPC crash leading to a Denial of Service (DoS).When specific SNMP GET operations or specific low-priviledged CLI commands are executed, a GUID resource leak will occur, eventually leading to exhaustion and resulting in FPCs to hang. Affected FPCs need to be manually restarted to recover.

GUID exhaustion will trigger a syslog message like one of the following:

evo-pfemand[<pid>]: get_next_guid: Ran out of Guid Space … evo-aftmand-zx[<pid>]: get_next_guid: Ran out of Guid Space … The leak can be monitored by running the following command and taking note of the values in the rightmost column labeled Guids:

user@host> show platform application-info allocations app evo-pfemand/evo-pfemand

In case one or more of these values are constantly increasing the leak is happening.

This issue affects Junos OS Evolved:

• All versions before 21.2R3-S8-EVO,

• 21.3 versions before 21.3R3-EVO;

• 21.4 versions before 22.1R2-EVO,

• 22.1 versions before 22.1R1-S1-EVO, 22.1R2-EVO.

Please note that this issue is similar to, but different from CVE-2024-47505 and CVE-2024-47509.

Affected Software

Weaknesses

• CWE-770: CWE-770 Allocation of Resources Without Limits or Throttling

Workarounds

There are no known workarounds for this issue.

To reduce the risk of exploitation of this issue, use access lists or firewall filters to limit access to only trusted networks, hosts and users.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://supportportal.juniper.net/

• ←Previous
• Next→