juniper junos 使用共享资源的并发执行不恰当同步问题(竞争条件)

CVE编号

CVE-2021-31364

利用情况

暂无

补丁情况

N/A

披露时间

2021-10-20
漏洞描述
An Improper Check for Unusual or Exceptional Conditions vulnerability combined with a Race Condition in the flow daemon (flowd) of Juniper Networks Junos OS on SRX300 Series, SRX500 Series, SRX1500, and SRX5000 Series with SPC2 allows an unauthenticated network based attacker sending specific traffic to cause a crash of the flowd/srxpfe process, responsible for traffic forwarding in SRX, which will cause a Denial of Service (DoS). Continued receipt and processing of this specific traffic will create a sustained Denial of Service (DoS) condition. This issue can only occur when specific packets are trying to create the same session and logging for session-close is configured as a policy action. Affected platforms are: SRX300 Series, SRX500 Series, SRX1500, and SRX5000 Series with SPC2. Not affected platforms are: SRX4000 Series, SRX5000 Series with SPC3, and vSRX Series. This issue affects Juniper Networks Junos OS SRX300 Series, SRX500 Series, SRX1500, and SRX5000 Series with SPC2: All versions prior to 17.4R3-S5; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R3-S9; 19.1 versions prior to 19.1R3-S6; 19.2 versions prior to 19.2R1-S7, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R3-S3; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R3; 20.3 versions prior to 20.3R2-S1, 20.3R3; 20.4 versions prior to 20.4R2.
解决建议
建议您更新当前系统或软件至最新版,完成漏洞的修复。
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
系统 juniper junos 17.4 -
运行在以下环境
系统 juniper junos 18.3 -
运行在以下环境
系统 juniper junos 18.4 -
运行在以下环境
系统 juniper junos 19.1 -
运行在以下环境
系统 juniper junos 19.2 -
运行在以下环境
系统 juniper junos 19.3 -
运行在以下环境
系统 juniper junos 19.4 -
运行在以下环境
系统 juniper junos 20.1 -
运行在以下环境
系统 juniper junos 20.2 -
运行在以下环境
系统 juniper junos 20.3 -
运行在以下环境
系统 juniper junos 20.4 -
运行在以下环境
硬件 juniper srx1500 - -
运行在以下环境
硬件 juniper srx300 - -
运行在以下环境
硬件 juniper srx320 - -
运行在以下环境
硬件 juniper srx340 - -
运行在以下环境
硬件 juniper srx345 - -
运行在以下环境
硬件 juniper srx380 - -
运行在以下环境
硬件 juniper srx5000 - -
运行在以下环境
硬件 juniper srx5400 - -
运行在以下环境
硬件 juniper srx550 - -
运行在以下环境
硬件 juniper srx550m - -
运行在以下环境
硬件 juniper srx550_hm - -
运行在以下环境
硬件 juniper srx5600 - -
运行在以下环境
硬件 juniper srx5800 - -
CVSS3评分
5.9
  • 攻击路径
    网络
  • 攻击复杂度
  • 权限要求
  • 影响范围
    未更改
  • 用户交互
  • 可用性
  • 保密性
  • 完整性
CWE-ID 漏洞类型
CWE-362 使用共享资源的并发执行不恰当同步问题(竞争条件)
CWE-754 对因果或异常条件的不恰当检查
阿里云安全产品覆盖情况