Vulnerabilities
Misconfiguration
Runtime Security
Compliance
CVE Vulnerabilities

CVE-2024-21606

Double Free

Published: Jan 12, 2024 | Modified: Jan 18, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2024-21606
CWEhttps://cwe.mitre.org/data/definitions/415.html

A Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS).

In a remote access VPN scenario, if a tcp-encap-profile is configured and a sequence of specific packets is received, a flowd crash and restart will be observed.

This issue affects Juniper Networks Junos OS on SRX Series:

  • All versions earlier than 20.4R3-S8;
  • 21.2 versions earlier than 21.2R3-S6;
  • 21.3 versions earlier than 21.3R3-S5;
  • 21.4 versions earlier than 21.4R3-S5;
  • 22.1 versions earlier than 22.1R3-S3;
  • 22.2 versions earlier than 22.2R3-S3;
  • 22.3 versions earlier than 22.3R3-S1;
  • 22.4 versions earlier than 22.4R2-S2, 22.4R3.

Weakness

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

Affected Software

Name Vendor Start Version End Version
Junos Juniper * 20.4 (excluding)
Junos Juniper 20.4 (including) 20.4 (including)
Junos Juniper 20.4-r1 (including) 20.4-r1 (including)
Junos Juniper 20.4-r1-s1 (including) 20.4-r1-s1 (including)
Junos Juniper 20.4-r2 (including) 20.4-r2 (including)
Junos Juniper 20.4-r2-s1 (including) 20.4-r2-s1 (including)
Junos Juniper 20.4-r2-s2 (including) 20.4-r2-s2 (including)
Junos Juniper 20.4-r3 (including) 20.4-r3 (including)
Junos Juniper 20.4-r3-s1 (including) 20.4-r3-s1 (including)
Junos Juniper 20.4-r3-s2 (including) 20.4-r3-s2 (including)
Junos Juniper 20.4-r3-s3 (including) 20.4-r3-s3 (including)
Junos Juniper 20.4-r3-s4 (including) 20.4-r3-s4 (including)
Junos Juniper 20.4-r3-s5 (including) 20.4-r3-s5 (including)
Junos Juniper 20.4-r3-s6 (including) 20.4-r3-s6 (including)
Junos Juniper 20.4-r3-s7 (including) 20.4-r3-s7 (including)
Junos Juniper 21.2 (including) 21.2 (including)
Junos Juniper 21.2-r1 (including) 21.2-r1 (including)
Junos Juniper 21.2-r1-s1 (including) 21.2-r1-s1 (including)
Junos Juniper 21.2-r1-s2 (including) 21.2-r1-s2 (including)
Junos Juniper 21.2-r2 (including) 21.2-r2 (including)
Junos Juniper 21.2-r2-s1 (including) 21.2-r2-s1 (including)
Junos Juniper 21.2-r2-s2 (including) 21.2-r2-s2 (including)
Junos Juniper 21.2-r3 (including) 21.2-r3 (including)
Junos Juniper 21.2-r3-s1 (including) 21.2-r3-s1 (including)
Junos Juniper 21.2-r3-s2 (including) 21.2-r3-s2 (including)
Junos Juniper 21.2-r3-s3 (including) 21.2-r3-s3 (including)
Junos Juniper 21.2-r3-s4 (including) 21.2-r3-s4 (including)
Junos Juniper 21.2-r3-s5 (including) 21.2-r3-s5 (including)
Junos Juniper 21.3 (including) 21.3 (including)
Junos Juniper 21.3-r1 (including) 21.3-r1 (including)
Junos Juniper 21.3-r1-s1 (including) 21.3-r1-s1 (including)
Junos Juniper 21.3-r1-s2 (including) 21.3-r1-s2 (including)
Junos Juniper 21.3-r2 (including) 21.3-r2 (including)
Junos Juniper 21.3-r2-s1 (including) 21.3-r2-s1 (including)
Junos Juniper 21.3-r2-s2 (including) 21.3-r2-s2 (including)
Junos Juniper 21.3-r3 (including) 21.3-r3 (including)
Junos Juniper 21.3-r3-s1 (including) 21.3-r3-s1 (including)
Junos Juniper 21.3-r3-s2 (including) 21.3-r3-s2 (including)
Junos Juniper 21.3-r3-s3 (including) 21.3-r3-s3 (including)
Junos Juniper 21.3-r3-s4 (including) 21.3-r3-s4 (including)
Junos Juniper 21.4 (including) 21.4 (including)
Junos Juniper 21.4-r1 (including) 21.4-r1 (including)
Junos Juniper 21.4-r1-s1 (including) 21.4-r1-s1 (including)
Junos Juniper 21.4-r1-s2 (including) 21.4-r1-s2 (including)
Junos Juniper 21.4-r2 (including) 21.4-r2 (including)
Junos Juniper 21.4-r2-s1 (including) 21.4-r2-s1 (including)
Junos Juniper 21.4-r2-s2 (including) 21.4-r2-s2 (including)
Junos Juniper 21.4-r3 (including) 21.4-r3 (including)
Junos Juniper 21.4-r3-s1 (including) 21.4-r3-s1 (including)
Junos Juniper 21.4-r3-s2 (including) 21.4-r3-s2 (including)
Junos Juniper 21.4-r3-s3 (including) 21.4-r3-s3 (including)
Junos Juniper 21.4-r3-s4 (including) 21.4-r3-s4 (including)
Junos Juniper 22.1 (including) 22.1 (including)
Junos Juniper 22.1-r1 (including) 22.1-r1 (including)
Junos Juniper 22.1-r1-s1 (including) 22.1-r1-s1 (including)
Junos Juniper 22.1-r1-s2 (including) 22.1-r1-s2 (including)
Junos Juniper 22.1-r2 (including) 22.1-r2 (including)
Junos Juniper 22.1-r2-s1 (including) 22.1-r2-s1 (including)
Junos Juniper 22.1-r2-s2 (including) 22.1-r2-s2 (including)
Junos Juniper 22.1-r3 (including) 22.1-r3 (including)
Junos Juniper 22.1-r3-s1 (including) 22.1-r3-s1 (including)
Junos Juniper 22.1-r3-s2 (including) 22.1-r3-s2 (including)
Junos Juniper 22.2 (including) 22.2 (including)
Junos Juniper 22.2-r1 (including) 22.2-r1 (including)
Junos Juniper 22.2-r1-s1 (including) 22.2-r1-s1 (including)
Junos Juniper 22.2-r1-s2 (including) 22.2-r1-s2 (including)
Junos Juniper 22.2-r2 (including) 22.2-r2 (including)
Junos Juniper 22.2-r2-s1 (including) 22.2-r2-s1 (including)
Junos Juniper 22.2-r2-s2 (including) 22.2-r2-s2 (including)
Junos Juniper 22.2-r3 (including) 22.2-r3 (including)
Junos Juniper 22.2-r3-s1 (including) 22.2-r3-s1 (including)
Junos Juniper 22.2-r3-s2 (including) 22.2-r3-s2 (including)
Junos Juniper 22.3 (including) 22.3 (including)
Junos Juniper 22.3-r1 (including) 22.3-r1 (including)
Junos Juniper 22.3-r1-s1 (including) 22.3-r1-s1 (including)
Junos Juniper 22.3-r1-s2 (including) 22.3-r1-s2 (including)
Junos Juniper 22.3-r2 (including) 22.3-r2 (including)
Junos Juniper 22.3-r2-s1 (including) 22.3-r2-s1 (including)
Junos Juniper 22.3-r2-s2 (including) 22.3-r2-s2 (including)
Junos Juniper 22.3-r3 (including) 22.3-r3 (including)
Junos Juniper 22.4 (including) 22.4 (including)
Junos Juniper 22.4-r1 (including) 22.4-r1 (including)
Junos Juniper 22.4-r1-s1 (including) 22.4-r1-s1 (including)
Junos Juniper 22.4-r1-s2 (including) 22.4-r1-s2 (including)
Junos Juniper 22.4-r2 (including) 22.4-r2 (including)
Junos Juniper 22.4-r2-s1 (including) 22.4-r2-s1 (including)

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2024 Aqua Security Software Ltd.   Privacy Policy | Terms of Use