Product Affected

This issue affects all versions of Junos OS. Affected platforms: All platforms.
Medium
CVSS 3.1: 4.3 (CVSS:3.1/AV:N/AC:L/PR:l/UI:N/S:U/C:N/I:N/A:L)
CVSS 4.0: 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Problem

An Improper Handling of Exceptional Conditions vulnerability in the Class of Service daemon (cosd) of Juniper Networks Junos OS allows an authenticated, network-based attacker with low privileges to cause a limited Denial of Service (DoS).

In a scaled CoS scenario with 1000s of interfaces, when specific low privileged commands, received over NETCONF, SSH or telnet, are handled by cosd on behalf of mgd, the respective child management daemon (mgd) processes will get stuck. In case of (Netconf over) SSH this leads to stuck SSH sessions, so that when the connection-limit for SSH is reached new sessions can't be established anymore. A similar behavior will be seen for telnet, etc.

Stuck mgd processes can be monitored by executing the following command:

  user@host> show system processes extensive | match mgd | match sbwait

This issue affects Juniper Networks Junos OS:

  • All versions earlier than 20.4R3-S9;
  • 21.2 versions earlier than 21.2R3-S7;
  • 21.3 versions earlier than 21.3R3-S5;
  • 21.4 versions earlier than 21.4R3-S5;
  • 22.1 versions earlier than 22.1R3-S4;
  • 22.2 versions earlier than 22.2R3-S3;
  • 22.3 versions earlier than 22.3R3-S2;
  • 22.4 versions earlier than 22.4R3;
  • 23.2 versions earlier than 23.2R1-S2, 23.2R2.

Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S3, 22.3R3-S2, 22.4R3, 23.2R1-S2, 23.2R2, 23.4R1, and all subsequent releases.

This issue is being tracked as 1757003 which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Workaround

While not a workaround, the number of stuck mgd processes can be monitored and once they reach a high level they can be proactively terminated.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History

2024-04-10: Initial Publication
2024-04-15: updated the CVSSv3.1 score from PR:N to PR:L which leads to a score change from 5.3 to 4.3
2024-09-13: Minor formatting change to cvss field.
2025-05-19: Update to reflect improved understanding of the scope of the issue: Neither MX nor subscriber management specific.

Related Information