fkie_cve-2024-39518
Vulnerability from fkie_nvd
Published
2024-07-10 23:15
Modified
2025-03-03 19:40
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A Heap-based Buffer Overflow vulnerability in the telemetry sensor process (sensord) of Juniper Networks Junos OS on MX240, MX480, MX960 platforms using MPC10E causes a steady increase in memory utilization, ultimately leading to a Denial of Service (DoS). When the device is subscribed to a specific subscription on Junos Telemetry Interface, a slow memory leak occurs and eventually all resources are consumed and the device becomes unresponsive. A manual reboot of the Line Card will be required to restore the device to its normal functioning.  This issue is only seen when telemetry subscription is active. The Heap memory utilization can be monitored using the following command:   > show system processes extensive The following command can be used to monitor the memory utilization of the specific sensor   > show system info | match sensord PID NAME MEMORY PEAK MEMORY %CPU THREAD-COUNT CORE-AFFINITY UPTIME 1986 sensord 877.57MB 877.57MB 2 4 0,2-15 7-21:41:32 This issue affects Junos OS:  * from 21.2R3-S5 before 21.2R3-S7,  * from 21.4R3-S4 before 21.4R3-S6,  * from 22.2R3 before 22.2R3-S4,  * from 22.3R2 before 22.3R3-S2,  * from 22.4R1 before 22.4R3,  * from 23.2R1 before 23.2R2.
References
sirt@juniper.nethttps://supportportal.juniper.net/JSA82982Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://supportportal.juniper.net/JSA82982Vendor Advisory
Impacted products
Vendor Product Version
juniper junos 21.2
juniper junos 21.2
juniper junos 21.4
juniper junos 21.4
juniper junos 22.2
juniper junos 22.2
juniper junos 22.2
juniper junos 22.2
juniper junos 22.3
juniper junos 22.3
juniper junos 22.3
juniper junos 22.3
juniper junos 22.3
juniper junos 22.4
juniper junos 22.4
juniper junos 22.4
juniper junos 22.4
juniper junos 22.4
juniper junos 22.4
juniper junos 23.2
juniper junos 23.2
juniper junos 23.2
juniper mx240 -
juniper mx480 -
juniper mx960 -


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:juniper:junos:21.2:r3-s5:*:*:*:*:*:*",
                     matchCriteriaId: "2307BF56-640F-49A8-B060-6ACB0F653A61",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:21.2:r3-s6:*:*:*:*:*:*",
                     matchCriteriaId: "737DDF96-7B1D-44E2-AD0F-E2F50858B2A3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:21.4:r3-s4:*:*:*:*:*:*",
                     matchCriteriaId: "3B457616-2D91-4913-9A7D-038BBF8F1F66",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:21.4:r3-s5:*:*:*:*:*:*",
                     matchCriteriaId: "C470FB4E-A927-4AF3-ACB0-AD1E264218B7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:22.2:r3:*:*:*:*:*:*",
                     matchCriteriaId: "591AA3E6-62A2-4A1A-A04C-E808F71D8B6E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:22.2:r3-s1:*:*:*:*:*:*",
                     matchCriteriaId: "786F993E-32CB-492A-A7CC-A7E4F48EA8B9",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:22.2:r3-s2:*:*:*:*:*:*",
                     matchCriteriaId: "60CEA89D-BAC4-41CD-A1D1-AA5EDDEBD54A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:22.2:r3-s3:*:*:*:*:*:*",
                     matchCriteriaId: "BC449CC7-B2D6-41CB-8D6C-81DE89E79520",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:22.3:r2:*:*:*:*:*:*",
                     matchCriteriaId: "59DDA54E-6845-47EB-AE3C-5EC6BD33DFA7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:22.3:r2-s1:*:*:*:*:*:*",
                     matchCriteriaId: "574730B0-56C8-4A03-867B-1737148ED9B1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:22.3:r2-s2:*:*:*:*:*:*",
                     matchCriteriaId: "20EBC676-1B26-4A71-8326-0F892124290A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:22.3:r3:*:*:*:*:*:*",
                     matchCriteriaId: "FB4C0FBF-8813-44E5-B71A-22CBAA603E2F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:22.3:r3-s1:*:*:*:*:*:*",
                     matchCriteriaId: "8BCDE58C-80CC-4C5A-9667-8A4468D8D76C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*",
                     matchCriteriaId: "28E42A41-7965-456B-B0AF-9D3229CE4D4C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*",
                     matchCriteriaId: "CB1A77D6-D3AD-481B-979C-8F778530B175",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*",
                     matchCriteriaId: "3A064B6B-A99B-4D8D-A62D-B00C7870BC30",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:*",
                     matchCriteriaId: "40813417-A938-4F74-A419-8C5188A35486",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:22.4:r2-s1:*:*:*:*:*:*",
                     matchCriteriaId: "7FC1BA1A-DF0E-4B15-86BA-24C60E546732",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:22.4:r2-s2:*:*:*:*:*:*",
                     matchCriteriaId: "EBB967BF-3495-476D-839A-9DBFCBE69F91",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*",
                     matchCriteriaId: "4B3B2FE1-C228-46BE-AC76-70C2687050AE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*",
                     matchCriteriaId: "F1B16FF0-900F-4AEE-B670-A537139F6909",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*",
                     matchCriteriaId: "B227E831-30FF-4BE1-B8B2-31829A5610A6",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:juniper:mx240:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F4A26704-A6A4-4C4F-9E12-A0A0259491EF",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:juniper:mx480:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "104858BD-D31D-40E0-8524-2EC311F10EAC",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:juniper:mx960:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B5E08E1E-0FE4-4294-9497-BBFFECA2A220",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A Heap-based Buffer Overflow vulnerability in the telemetry sensor process (sensord) of Juniper Networks Junos OS on MX240, MX480, MX960 platforms using MPC10E causes a steady increase in memory utilization, ultimately leading to a Denial of Service (DoS).\n\nWhen the device is subscribed to a specific subscription on Junos Telemetry Interface, a slow memory leak occurs and eventually all resources are consumed and the device becomes unresponsive. A manual reboot of the Line Card will be required to restore the device to its normal functioning. \n\nThis issue is only seen when telemetry subscription is active.\n\nThe Heap memory utilization can be monitored using the following command:\n  > show system processes extensive\n\nThe following command can be used to monitor the memory utilization of the specific sensor\n  > show system info | match sensord\n   PID   NAME                 MEMORY     PEAK MEMORY    %CPU   THREAD-COUNT CORE-AFFINITY   UPTIME\n\n   1986  sensord            877.57MB   877.57MB         2       4           0,2-15          7-21:41:32\n\n\nThis issue affects Junos OS: \n\n\n\n  *  from 21.2R3-S5 before 21.2R3-S7, \n  *  from 21.4R3-S4 before 21.4R3-S6, \n  *  from 22.2R3 before 22.2R3-S4, \n  *  from 22.3R2 before 22.3R3-S2, \n  *  from 22.4R1 before 22.4R3, \n  *  from 23.2R1 before 23.2R2.",
      },
      {
         lang: "es",
         value: "Una vulnerabilidad de desbordamiento de búfer de almacenamiento dinámico en el proceso del sensor de telemetría (sensord) de Juniper Networks Junos OS en plataformas MX240, MX480, MX960 que utilizan MPC10E provoca un aumento constante en la utilización de la memoria, lo que en última instancia conduce a una denegación de servicio (DoS). Cuando el dispositivo está suscrito a una suscripción específica en Junos Telemetry Interface, se produce una pérdida lenta de memoria y, finalmente, se consumen todos los recursos y el dispositivo deja de responder. Será necesario reiniciar manualmente la tarjeta de línea para restaurar el dispositivo a su funcionamiento normal. Este problema solo se ve cuando la suscripción de telemetría está activa. La utilización de la memoria del montón se puede monitorear usando el siguiente comando: > show system processes extensive El siguiente comando se puede usar para monitorear la utilización de la memoria del sensor específico > show system info | match sensord NOMBRE PID MEMORIA PICO DE MEMORIA %CPU NÚMERO DE HILOS CORE-AFFINITY UPTIME 1986 sensord 877.57MB 877.57MB 2 4 0,2-15 7-21:41:32 Este problema afecta a Junos OS: * de 21.2R3-S5 antes de 21.2 R3-S7, * de 21.4R3-S4 antes de 21.4R3-S6, * de 22.2R3 antes de 22.2R3-S4, * de 22.3R2 antes de 22.3R3-S2, * de 22.4R1 antes de 22.4R3, * de 23.2R1 antes de 23.2 R2.",
      },
   ],
   id: "CVE-2024-39518",
   lastModified: "2025-03-03T19:40:47.773",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "sirt@juniper.net",
            type: "Primary",
         },
      ],
      cvssMetricV40: [
         {
            cvssData: {
               Automatable: "NOT_DEFINED",
               Recovery: "NOT_DEFINED",
               Safety: "NOT_DEFINED",
               attackComplexity: "LOW",
               attackRequirements: "NONE",
               attackVector: "NETWORK",
               availabilityRequirement: "NOT_DEFINED",
               baseScore: 8.7,
               baseSeverity: "HIGH",
               confidentialityRequirement: "NOT_DEFINED",
               exploitMaturity: "NOT_DEFINED",
               integrityRequirement: "NOT_DEFINED",
               modifiedAttackComplexity: "NOT_DEFINED",
               modifiedAttackRequirements: "NOT_DEFINED",
               modifiedAttackVector: "NOT_DEFINED",
               modifiedPrivilegesRequired: "NOT_DEFINED",
               modifiedSubAvailabilityImpact: "NOT_DEFINED",
               modifiedSubConfidentialityImpact: "NOT_DEFINED",
               modifiedSubIntegrityImpact: "NOT_DEFINED",
               modifiedUserInteraction: "NOT_DEFINED",
               modifiedVulnAvailabilityImpact: "NOT_DEFINED",
               modifiedVulnConfidentialityImpact: "NOT_DEFINED",
               modifiedVulnIntegrityImpact: "NOT_DEFINED",
               privilegesRequired: "NONE",
               providerUrgency: "NOT_DEFINED",
               subAvailabilityImpact: "LOW",
               subConfidentialityImpact: "NONE",
               subIntegrityImpact: "NONE",
               userInteraction: "NONE",
               valueDensity: "NOT_DEFINED",
               vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
               version: "4.0",
               vulnAvailabilityImpact: "HIGH",
               vulnConfidentialityImpact: "NONE",
               vulnIntegrityImpact: "NONE",
               vulnerabilityResponseEffort: "NOT_DEFINED",
            },
            source: "sirt@juniper.net",
            type: "Primary",
         },
      ],
   },
   published: "2024-07-10T23:15:11.363",
   references: [
      {
         source: "sirt@juniper.net",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://supportportal.juniper.net/JSA82982",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://supportportal.juniper.net/JSA82982",
      },
   ],
   sourceIdentifier: "sirt@juniper.net",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-122",
            },
         ],
         source: "sirt@juniper.net",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.