Denial-of-Service in Juniper Junos OS via l2ald Crash

Executive Summary

This vulnerability is a Return of Pointer Value Outside of Expected Range issue in the fileio library of Juniper Networks Junos OS and Junos OS Evolved. It allows a local, low-privileged attacker to cause a Denial-of-Service (DoS) by issuing a specific 'show l2-learning' command.

On EX Series, QFX Series, and MX Series devices, this command causes the l2ald process to crash, resulting in a temporary service impact for all layer 2 services until the process automatically restarts.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by observing if a low-privileged user is able to cause a crash of the l2ald process by issuing a specific command.

Specifically, the vulnerability is triggered by a low-privileged attacker issuing the 'show l2-learning' command on affected Juniper devices.

Therefore, monitoring for unusual or unauthorized use of the 'show l2-learning' command by low-privileged users can help detect attempts to exploit this vulnerability.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause a Denial-of-Service (DoS) condition on affected Juniper devices by crashing the l2ald process.

This leads to a temporary disruption of all layer 2 services on EX Series, QFX Series, and MX Series devices until the affected process restarts automatically.

Since the attacker only needs low privileges and local access to trigger this, it could impact network availability and service continuity.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade affected Junos OS or Junos OS Evolved versions to the fixed releases.

• For Junos OS, upgrade to versions 23.2R2-S7 or later, 23.4R2-S7 or later, 24.2R2 or later, or 24.4R1-S2 or later.
• For Junos OS Evolved, upgrade to versions 23.2R2-S7-EVO or later, 23.4R2-S8-EVO or later, 24.2R2-EVO or later, or 24.4R1-S3-EVO or later.

Until the upgrade is applied, restrict access to the 'show l2-learning' command for low-privileged users to prevent triggering the l2ald crash.

Useful 0 Not Useful 0