A Missing Synchronization vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on ACX5448 and ACX710 allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).

If an interface flaps while the system gathers statistics on that interface, two processes simultaneously access a shared resource which leads to a PFE crash and restart.
 

This issue affects Junos OS:

• All versions before 20.4R3-S9,
• 21.2 versions before 21.2R3-S5, 
• 21.3 versions before 21.3R3-S5, 
• 21.4 versions before 21.4R3-S4,
• 22.1 versions before 22.1R3-S2,
• 22.2 versions before 22.2R3-S2,
• 22.3 versions before 22.3R2-S2, 22.3R3,
• 22.4 versions before 22.4R2.

The following software releases have been updated to resolve this specific issue: 20.4R3-S9, 21.2R3-S5, 21.3R3-S5, 21.4R3-S4, 22.1R3-S2, 22.2R3-S2, 22.3R2-S2, 22.3R3, 22.4R2, 23.2R1, and all subsequent releases.

This issue is being tracked as 1702544 which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

2024-04-10 - Initial Publication
2024-09-13: Minor formatting change to CVSS field

• https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• https://www.cve.org/CVERecord?id=CVE-2024-30387