Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveJuniperCVE-2024-30386
HistoryApr 12, 2024 - 4:15 p.m.

CVE-2024-30386

2024-04-1216:15:37
CWE-416
juniper
web.nvd.nist.gov
47
cve-2024-30386
layer 2 address learning daemon
juniper networks
evpn-vxlan
adjacent attacker
system crash
software versions

CVSS3

5.3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS4

7.1

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/SC:N/VI:N/SI:N/VA:H/SA:L

AI Score

6.7

Confidence

Low

EPSS

0

Percentile

12.7%

JSON

A Use-After-Free vulnerability in the Layer 2 Address Learning Daemon (l2ald)

of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause l2ald to crash leading to a Denial-of-Service (DoS).

In an EVPN-VXLAN scenario, when

state updates are received and processed by the affected system, the correct order of some processing steps is not ensured, which can lead to an l2ald crash and restart. Whether the crash occurs depends on system internal timing which is outside the attackers control.
This issue affects:

Junos OS:

  • All versions before 20.4R3-S8,
  • 21.2 versions before 21.2R3-S6,
  • 21.3 versions before 21.3R3-S5,
  • 21.4 versions before 21.4R3-S4,
  • 22.1 versions before 22.1R3-S3,
  • 22.2 versions before 22.2R3-S1,
  • 22.3 versions before 22.3R3,
  • 22.4 versions before 22.4R2;

Junos OS Evolved:

  • All versions before 20.4R3-S8-EVO,
  • 21.2-EVO versions before 21.2R3-S6-EVO,
  • 21.3-EVO

versions before 21.3R3-S5-EVO,

  • 21.4-EVO

versions before 21.4R3-S4-EVO,

  • 22.1-EVO

versions before 22.1R3-S3-EVO,

  • 22.2-EVO

versions before 22.2R3-S1-EVO,

  • 22.3-EVO

versions before 22.3R3-EVO,

  • 22.4-EVO

versions before 22.4R2-EVO.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Junos OS",
    "vendor": "Juniper Networks",
    "versions": [
      {
        "lessThan": "20.4R3-S8",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThan": "21.2R3-S6",
        "status": "affected",
        "version": "21.2",
        "versionType": "semver"
      },
      {
        "lessThan": "21.3R3-S5",
        "status": "affected",
        "version": "21.3",
        "versionType": "semver"
      },
      {
        "lessThan": "21.4R3-S4",
        "status": "affected",
        "version": "21.4",
        "versionType": "semver"
      },
      {
        "lessThan": "22.1R3-S3",
        "status": "affected",
        "version": "22.1",
        "versionType": "semver"
      },
      {
        "lessThan": "22.2R3-S1",
        "status": "affected",
        "version": "22.2",
        "versionType": "semver"
      },
      {
        "lessThan": "22.3R3",
        "status": "affected",
        "version": "22.3",
        "versionType": "semver"
      },
      {
        "lessThan": "22.4R2",
        "status": "affected",
        "version": "22.4",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Junos OS Evolved",
    "vendor": "Juniper Networks",
    "versions": [
      {
        "lessThan": "20.4R3-S8-EVO",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThan": "21.2R3-S6-EVO",
        "status": "affected",
        "version": "21.2-EVO",
        "versionType": "semver"
      },
      {
        "lessThan": "21.3R3-S5-EVO",
        "status": "affected",
        "version": "21.3-EVO",
        "versionType": "semver"
      },
      {
        "lessThan": "21.4R3-S4-EVO",
        "status": "affected",
        "version": "21.4-EVO",
        "versionType": "semver"
      },
      {
        "lessThan": "22.1R3-S3-EVO",
        "status": "affected",
        "version": "22.1-EVO",
        "versionType": "semver"
      },
      {
        "lessThan": "22.2R3-S1-EVO",
        "status": "affected",
        "version": "22.2-EVO",
        "versionType": "semver"
      },
      {
        "lessThan": "22.3R3-EVO",
        "status": "affected",
        "version": "22.3-EVO",
        "versionType": "semver"
      },
      {
        "lessThan": "22.4R2-EVO",
        "status": "affected",
        "version": "22.4-EVO",
        "versionType": "semver"
      }
    ]
  }
]

Related

nessus 1
nvd 1
cvelist 1
vulnrichment 1
nessus
nessus
Juniper Junos OS Vulnerability (JSA79184)
2024-05-08 00:00:00
nvd
nvd
CVE-2024-30386
2024-04-12 16:15:37
cvelist
cvelist
CVE-2024-30386 Junos OS and Junos OS Evolved: In a EVPN-VXLAN scenario state changes on adjacent systems can cause an l2ald process crash
2024-04-12 15:23:24
vulnrichment
vulnrichment
CVE-2024-30386 Junos OS and Junos OS Evolved: In a EVPN-VXLAN scenario state changes on adjacent systems can cause an l2ald process crash
2024-04-12 15:23:24

CVSS3

5.3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS4

7.1

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/SC:N/VI:N/SI:N/VA:H/SA:L

AI Score

6.7

Confidence

Low

EPSS

0

Percentile

12.7%

JSON
Related for CVE-2024-30386
nessus1nvd1cvelist1vulnrichment1