title: Junos OS: jdhcpd will hang on receiving a specific DHCP packet
description:
An Improper Check for Unusual or Exceptional Conditions vulnerability in Juniper DHCP Daemon (jdhcpd) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause the jdhcpd to consume all the CPU cycles resulting in a Denial of Service (DoS).
On Junos OS devices with forward-snooped-client configured, if an attacker sends a specific DHCP packet to a non-configured interface, this will cause an infinite loop. The DHCP process will have to be restarted to recover the service.
This issue affects:
Juniper Networks Junos OS
*  All versions earlier than 20.4R3-S9;
*  21.2 versions earlier than 21.2R3-S7;
*  21.3 versions earlier than 21.3R3-S5;
*  21.4 versions earlier than 21.4R3-S5;
*  22.1 versions earlier than 22.1R3-S4;
*  22.2 versions earlier than 22.2R3-S3;
*  22.3 versions earlier than 22.3R3-S2;
*  22.4 versions earlier than 22.4R2-S2, 22.4R3;
*  23.2 versions earlier than 23.2R2.
problem types: CWE-703: Improper Check or Handling of Exceptional Conditions
affected:
{
defaultStatus: unaffected
platforms: [MX Series, EX Series]
product: Junos OS
vendor: Juniper Networks
versions:
lessThan: 20.4R3-S9, status: affected, version: 0, versionType: semver
lessThan: 21.2R3-S7, status: affected, version: 21.2, versionType: semver
lessThan: 21.3R3-S5, status: affected, version: 21.3, versionType: semver
lessThan: 21.4R3-S5, status: affected, version: 21.4, versionType: semver
lessThan: 22.1R3-S4, status: affected, version: 22.1, versionType: semver
lessThan: 22.2R3-S3, status: affected, version: 22.2, versionType: semver
lessThan: 22.3R3-S2, status: affected, version: 22.3, versionType: semver
lessThan: 22.4R2-S2, 22.4R3, status: affected, version: 22.4, versionType: semver
lessThan: 23.2R2, status: affected, version: 23.2, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: The following software releases have been updated to resolve this specific issue: Junos OS 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S3, 22.3R3-S2, 22.4R2-S2, 22.4R3, 23.2R1-S2, 23.2R2, 23.4R1, and all subsequent releases.
workarounds: There are no known workarounds for this issue.