A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an adjacent, unauthenticated attacker to cause a Denial-of-Service (DoS). When the reachability of an sFlow collector changes, the corresponding next-hop entry is updated. If this update occurs simultaneously with the sFlow thread accessing the next-hop data (which is outside the attackers control), it causes the evo-pfemand process to crash, impacting all traffic forwarding until the automatic process restart has completed.
This issue affects Junos OS Evolved on QFX Series: * all 23.2 versions, * 23.4 versions before 23.4R2-S7-EVO, * 24.2 versions before 24.2R2-S5-EVO, * 24.4 versions before 24.4R2-S3-EVO, * 25.2 versions before 25.2R2-EVO.
Attack Parameters
Attack Vector
Adjacent
Requires local network access
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 45
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:23.2:*:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:23.4:-:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:23.4:r1:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:23.4:r1-s1:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:23.4:r1-s2:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s1:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s2:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s3:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s4:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s5:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s6:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:24.2:-:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:24.2:r1:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:24.2:r1-s2:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:24.2:r2:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s1:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s2:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s3:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s4:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:24.4:-:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:24.4:r1:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:24.4:r1-s2:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:24.4:r1-s3:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:24.4:r2:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s1:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s2:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:25.2:-:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:25.2:r1:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:25.2:r1-s1:*:*:*:*:*:*
|
— | — |
|
Juniper Junos_Os_Evolved
cpe:2.3:o:juniper:junos_os_evolved:25.2:r1-s2:*:*:*:*:*:*
|
— | — |
|
Juniper Qfx10008
cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:*
|
— | — |
|
Juniper Qfx10016
cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:*
|
— | — |
|
Juniper Qfx5110
cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*
|
— | — |
|
Juniper Qfx5120
cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*
|
— | — |
|
Juniper Qfx5130
cpe:2.3:h:juniper:qfx5130:-:*:*:*:*:*:*:*
|
— | — |
|
Juniper Qfx5140
cpe:2.3:h:juniper:qfx5140:-:*:*:*:*:*:*:*
|
— | — |
|
Juniper Qfx5200
cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*
|
— | — |
|
Juniper Qfx5210
cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*
|
— | — |
|
Juniper Qfx5220
cpe:2.3:h:juniper:qfx5220:-:*:*:*:*:*:*:*
|
— | — |
|
Juniper Qfx5230-64cd
cpe:2.3:h:juniper:qfx5230-64cd:-:*:*:*:*:*:*:*
|
— | — |
|
Juniper Qfx5240
cpe:2.3:h:juniper:qfx5240:-:*:*:*:*:*:*:*
|
— | — |
|
Juniper Qfx5241
cpe:2.3:h:juniper:qfx5241:-:*:*:*:*:*:*:*
|
— | — |
|
Juniper Qfx5250
cpe:2.3:h:juniper:qfx5250:-:*:*:*:*:*:*:*
|
— | — |
|
Juniper Qfx5700
cpe:2.3:h:juniper:qfx5700:-:*:*:*:*:*:*:*
|
— | — |