{"id":"CVE-2025-52948","state":"PUBLISHED","title":"Junos OS: Specific unknown traffic pattern causes FPC and system to crash when packet capturing is enabled","description":"An Improper Handling of Exceptional Conditions vulnerability in Berkeley Packet Filter (BPF) processing of Juniper Networks Junos OS allows an attacker, in rare cases, sending specific, unknown traffic patterns to cause the FPC and system to crash and restart.\n\nBPF provides a raw interface to data link layers in a protocol independent fashion. Internally within the Junos kernel, due to a rare timing issue (race condition), when a BPF instance is cloned, the newly created interface causes an internal structure leakage, leading to a system crash. The precise content and timing of the traffic patterns is indeterminate, but has been seen in a lab environment multiple times.\n\nThis issue is more likely to occur when packet capturing is enabled.  See required configuration below.\n\nThis issue affects Junos OS: \n\n\n\n  *  all versions before 21.2R3-S9, \n  *  from 21.4 before 21.4R3-S10, \n  *  from 22.2 before 22.2R3-S6, \n  *  from 22.4 before 22.4R3-S7, \n  *  from 23.2 before 23.2R2-S3, \n  *  from 23.4 before 23.4R2-S3, \n  *  from 24.2 before 24.2R1-S1, 24.2R2.","publishedAt":"2025-07-11T14:40:31.197Z","updatedAt":"2025-07-23T14:57:37.021Z","severity":{"score":8.2,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M","source":"juniper"},"assigner":"juniper","products":["Juniper Networks Junos OS"],"affected":[{"vendor":"Juniper Networks","product":"Junos OS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"21.2R3-S9","versionType":"semver"},{"version":"21.4","status":"affected","lessThan":"21.4R3-S10","versionType":"semver"},{"version":"22.2","status":"affected","lessThan":"22.2R3-S6","versionType":"semver"},{"version":"22.4","status":"affected","lessThan":"22.4R3-S7","versionType":"semver"},{"version":"23.2","status":"affected","lessThan":"23.2R2-S3","versionType":"semver"},{"version":"23.4","status":"affected","lessThan":"23.4R2-S3","versionType":"semver"},{"version":"24.2","status":"affected","lessThan":"24.2R1-S1, 24.2R2","versionType":"semver"}]}],"references":["https://supportportal.juniper.net/JSA100052","https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/topic-map/analyze-network-traffic-by-using-packet-capture.html"],"weaknesses":["CWE-755"],"ingestedAt":"2026-10-29T20:09:31.862Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/52xxx/CVE-2025-52948.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-52948","state":"PUBLISHED","datePublished":"2025-07-11T14:40:31.197Z","dateUpdated":"2025-07-23T14:57:37.021Z","assignerShortName":"juniper","assignerOrgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","dateReserved":"2025-06-23T13:16:01.408Z"},"containers":{"cna":{"title":"Junos OS: Specific unknown traffic pattern causes FPC and system to crash when packet capturing is enabled","descriptions":[{"lang":"en","value":"An Improper Handling of Exceptional Conditions vulnerability in Berkeley Packet Filter (BPF) processing of Juniper Networks Junos OS allows an attacker, in rare cases, sending specific, unknown traffic patterns to cause the FPC and system to crash and restart.\n\nBPF provides a raw interface to data link layers in a protocol independent fashion. Internally within the Junos kernel, due to a rare timing issue (race condition), when a BPF instance is cloned, the newly created interface causes an internal structure leakage, leading to a system crash. The precise content and timing of the traffic patterns is indeterminate, but has been seen in a lab environment multiple times.\n\nThis issue is more likely to occur when packet capturing is enabled.  See required configuration below.\n\nThis issue affects Junos OS: \n\n\n\n  *  all versions before 21.2R3-S9, \n  *  from 21.4 before 21.4R3-S10, \n  *  from 22.2 before 22.2R3-S6, \n  *  from 22.4 before 22.4R3-S7, \n  *  from 23.2 before 23.2R2-S3, \n  *  from 23.4 before 23.4R2-S3, \n  *  from 24.2 before 24.2R1-S1, 24.2R2."}],"affected":[{"vendor":"Juniper Networks","product":"Junos OS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"21.2R3-S9","versionType":"semver"},{"version":"21.4","status":"affected","lessThan":"21.4R3-S10","versionType":"semver"},{"version":"22.2","status":"affected","lessThan":"22.2R3-S6","versionType":"semver"},{"version":"22.4","status":"affected","lessThan":"22.4R3-S7","versionType":"semver"},{"version":"23.2","status":"affected","lessThan":"23.2R2-S3","versionType":"semver"},{"version":"23.4","status":"affected","lessThan":"23.4R2-S3","versionType":"semver"},{"version":"24.2","status":"affected","lessThan":"24.2R1-S1, 24.2R2","versionType":"semver"}]}],"references":[{"url":"https://supportportal.juniper.net/JSA100052","tags":["vendor-advisory"]},{"url":"https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/topic-map/analyze-network-traffic-by-using-packet-capture.html","tags":["technical-description"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"YES","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":8.2,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"MODERATE"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-755","description":"CWE-755 Improper Handling of Exceptional Conditions","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"juniper","orgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","dateUpdated":"2025-07-23T14:57:37.021Z"},"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"BPF is used by applications such as 'tcpdump', enabled in Junos via packet-capture sampling:<br><br>\n\n<tt>[forwarding-options&nbsp;packet-capture file ...]<br><br>[firewall filter &lt;name&gt; term &lt;name&gt; then sample]<br><br>[interfaces &lt;interface&gt; unit &lt;n&gt; family inet filter input &lt;name&gt;]<br>\n\n[interfaces &lt;interface&gt; unit &lt;n&gt; family inet filter output &lt;name&gt;]<br><br></tt>or via the 'monitor traffic' command. For example:<br><br><tt>user@junos&gt; monitor traffic interface &lt;name&gt;</tt>"}],"value":"BPF is used by applications such as 'tcpdump', enabled in Junos via packet-capture sampling:\n\n\n\n[forwarding-options packet-capture file ...]\n\n[firewall filter <name> term <name> then sample]\n\n[interfaces <interface> unit <n> family inet filter input <name>]\n\n\n[interfaces <interface> unit <n> family inet filter output <name>]\n\nor via the 'monitor traffic' command. For example:\n\nuser@junos> monitor traffic interface <name>"}],"datePublic":"2025-07-09T16:00:00.000Z","exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The following software releases have been updated to resolve this specific issue: 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S7, 23.2R2-S3, 23.4R2-S3, 24.2R1-S1, 24.2R2, 24.4R1, and all subsequent releases."}],"value":"The following software releases have been updated to resolve this specific issue: 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S7, 23.2R2-S3, 23.4R2-S3, 24.2R1-S1, 24.2R2, 24.4R1, and all subsequent releases."}],"source":{"advisory":"JSA100052","defect":["1819102"],"discovery":"INTERNAL"},"timeline":[{"lang":"en","time":"2025-07-09T16:00:00.000Z","value":"Initial Publication"},{"lang":"en","time":"2025-07-18T16:00:00.000Z","value":"Corrected vulnerable 'monitor' command from 'monitor interface' to 'monitor traffic'"},{"lang":"en","time":"2025-07-23T16:00:00.000Z","value":"Added workaround of avoiding the execution of the 'monitor traffic' command"}],"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Avoid execution of the 'monitor traffic interface' command on production systems."}],"value":"Avoid execution of the 'monitor traffic interface' command on production systems."}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-11T15:06:42.389399Z","id":"CVE-2025-52948","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-07-11T15:06:47.179Z"}}]}}}