PT-2023-2577 · Juniper Networks · Junos

Published 2023-04-12 · Updated 2023-05-01 · CVE-2023-28984

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 19.4R3-S10 on QFX Series Juniper Networks Junos OS 20.2 versions prior to 20.2R3-S7 on QFX Series Juniper Networks Junos OS 20.3 versions prior to 20.3R3-S6 on QFX Series Juniper Networks Junos OS 20.4 versions prior to 20.4R3-S5 on QFX Series Juniper Networks Junos OS 21.1 versions prior to 21.1R3-S4 on QFX Series Juniper Networks Junos OS 21.2 versions prior to 21.2R3-S3 on QFX Series Juniper Networks Junos OS 21.3 versions prior to 21.3R3-S3 on QFX Series Juniper Networks Junos OS 21.4 versions prior to 21.4R3 on QFX Series Juniper Networks Junos OS 22.1 versions prior to 22.1R3 on QFX Series Juniper Networks Junos OS 22.2 versions prior to 22.2R2 on QFX Series

Description A Use After Free vulnerability in the Layer 2 Address Learning Manager (l2alm) of Juniper Networks Junos OS on QFX Series allows an adjacent attacker to cause the Packet Forwarding Engine to crash and restart, leading to a Denial of Service (DoS). The PFE may crash when a lot of MAC learning and aging happens, but due to a Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization) that is outside the attacker's direct control.

Recommendations For Juniper Networks Junos OS versions prior to 19.4R3-S10 on QFX Series, update to version 19.4R3-S10 or later. For Juniper Networks Junos OS 20.2 versions prior to 20.2R3-S7 on QFX Series, update to version 20.2R3-S7 or later. For Juniper Networks Junos OS 20.3 versions prior to 20.3R3-S6 on QFX Series, update to version 20.3R3-S6 or later. For Juniper Networks Junos OS 20.4 versions prior to 20.4R3-S5 on QFX Series, update to version 20.4R3-S5 or later. For Juniper Networks Junos OS 21.1 versions prior to 21.1R3-S4 on QFX Series, update to version 21.1R3-S4 or later. For Juniper Networks Junos OS 21.2 versions prior to 21.2R3-S3 on QFX Series, update to version 21.2R3-S3 or later. For Juniper Networks Junos OS 21.3 versions prior to 21.3R3-S3 on QFX Series, update to version 21.3R3-S3 or later. For Juniper Networks Junos OS 21.4 versions prior to 21.4R3 on QFX Series, update to version 21.4R3 or later. For Juniper Networks Junos OS 22.1 versions prior to 22.1R3 on QFX Series, update to version 22.1R3 or later. For Juniper Networks Junos OS 22.2 versions prior to 22.2R2 on QFX Series, update to version 22.2R2 or later.

Fix

DoS

Race Condition

Use After Free

Weakness Enumeration

CWE-362

CWE-416

Related Identifiers

BDU:2023-02393

CVE-2023-28984

Affected Products

Junos

References · 7

• https://bdu.fstec.ru/vul/2023-02393 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28984 · Vendor Advisory
• https://supportportal.juniper.net/JSA70610 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28984 · Security Note
• https://cybersecurity-help.cz/vdb/SB2023041345 · Note
• https://t.me/cvenotify/49545 · Telegram Post
• https://supportportal.juniper.net/s/article/2023-04-Security-Bulletin-Junos-OS-QFX-Series-The-PFE-may-crash-when-a-lot-of-MAC-addresses-are-being-learned-and-aged-CVE-2023-28984?language=en_US · Note