PT-2024-7132 · Juniper Networks · Junos

Published 2024-09-25 · Updated 2026-01-26 · CVE-2024-47493

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:X/U:Green

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 21.2R3-S7 Junos OS versions from 21.4 before 21.4R3-S6 Junos OS versions from 22.1 before 22.1R3-S5 Junos OS versions from 22.2 before 22.2R3-S3 Junos OS versions from 22.3 before 22.3R3-S2 Junos OS versions from 22.4 before 22.4R3 Junos OS versions from 23.2 before 23.2R2 Junos OS versions from 23.4 before 23.4R2

Description A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of the Juniper Networks Junos OS on the MX Series platforms with Trio-based FPCs allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). In case of channelized Modular Interface Cards (MICs), every physical interface flap operation will leak heap memory. Over a period of time, continuous physical interface flap operations causes local FPC to eventually run out of memory and crash. The issue can be checked using the CLI command show chassis fpc.

Recommendations Update to Junos OS version 21.2R3-S7 or later for versions prior to 21.2R3-S7 Update to Junos OS version 21.4R3-S6 or later for versions from 21.4 before 21.4R3-S6 Update to Junos OS version 22.1R3-S5 or later for versions from 22.1 before 22.1R3-S5 Update to Junos OS version 22.2R3-S3 or later for versions from 22.2 before 22.2R3-S3 Update to Junos OS version 22.3R3-S2 or later for versions from 22.3 before 22.3R3-S2 Update to Junos OS version 22.4R3 or later for versions from 22.4 before 22.4R3 Update to Junos OS version 23.2R2 or later for versions from 23.2 before 23.2R2 Update to Junos OS version 23.4R2 or later for versions from 23.4 before 23.4R2

Fix

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2024-08462

CVE-2024-47493

Affected Products

Junos

References · 17

• https://supportportal.juniper.net · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47493 · Security Note
• https://bdu.fstec.ru/vul/2024-08462 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47493 · Vendor Advisory
• https://security-database.com/detail.php?alert=CVE-2024-47493 · Note
• https://twitter.com/transilienceai/status/1845331482782437702 · Twitter Post
• https://juniper.net/documentation/us/en/software/junos/interfaces-link-multilink/topics/topic-map/link-multilink-services-understanding.html#id-multilink-interfaces-on-channelized-mics-overview · Note
• https://twitter.com/transilienceai/status/1845331469209629032 · Twitter Post
• https://twitter.com/transilienceai/status/1845331456991572270 · Twitter Post
• https://twitter.com/transilienceai/status/1845331474855141759 · Twitter Post
• https://t.me/cvenotify/101111 · Telegram Post
• https://t.me/cveNotify/149902 · Telegram Post
• https://twitter.com/transilienceai/status/1845331462528078202 · Twitter Post
• https://twitter.com/transilienceai/status/1845331488801255705 · Twitter Post
• https://t.me/latest_high_impact_cve/1306 · Telegram Post