{"{\"score\":6.5,\"description\":\"An Improper Validation of Syntactic Correctness of Input vulnerability\"}"}

CVE-2024-39542

Summary

An improper validation of syntactic correctness of input in Juniper Networks' Junos OS, affecting the Packet Forwarding Engine (PFE), allows unauthenticated network-based attackers to induce a Denial-of-Service (DoS). This vulnerability manifests in two specific scenarios. The first scenario occurs when devices configured with both SFLOW and ECMP encounter specific valid transit traffic that triggers a crash in the packetio process, causing an overall failure in the forwarding control plane (FPC) until a restart is performed. This scenario is pertinent to the PTX Series but does not apply to ACX or MX Series devices. The second scenario arises when a malformed CFM packet is received on an interface configured with CFM, similarly resulting in a packetio crash and subsequent FPC failure requiring a restart. These vulnerabilities pose significant operational risks, making it crucial for users to roadmap necessary mitigations.

References