PT-2024-1109 · Juniper Networks · Junos+1

Published 2024-01-10 · Updated 2024-01-19 · CVE-2024-21613

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 21.2R3-S3 Juniper Networks Junos OS versions 21.3 prior to 21.3R3-S5 Juniper Networks Junos OS versions 21.4 prior to 21.4R3-S3 Juniper Networks Junos OS versions 22.1 prior to 22.1R3 Juniper Networks Junos OS versions 22.2 prior to 22.2R3 Juniper Networks Junos OS Evolved versions prior to 21.3R3-S5-EVO Juniper Networks Junos OS Evolved versions 21.4 prior to 21.4R3-EVO Juniper Networks Junos OS Evolved versions 22.1 prior to 22.1R3-EVO Juniper Networks Junos OS Evolved versions 22.2 prior to 22.2R3-EVO

Description A Missing Release of Memory after Effective Lifetime issue in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause an rpd crash, leading to Denial of Service (DoS). When traffic engineering is enabled for OSPF or ISIS, and a link flaps, a patroot memory leak is observed, which over time will lead to an rpd crash and restart. The memory usage can be monitored using the command show task memory detail | match patroot.

Recommendations For Juniper Networks Junos OS versions prior to 21.2R3-S3, update to version 21.2R3-S3 or later. For Juniper Networks Junos OS versions 21.3 prior to 21.3R3-S5, update to version 21.3R3-S5 or later. For Juniper Networks Junos OS versions 21.4 prior to 21.4R3-S3, update to version 21.4R3-S3 or later. For Juniper Networks Junos OS versions 22.1 prior to 22.1R3, update to version 22.1R3 or later. For Juniper Networks Junos OS versions 22.2 prior to 22.2R3, update to version 22.2R3 or later. For Juniper Networks Junos OS Evolved versions prior to 21.3R3-S5-EVO, update to version 21.3R3-S5-EVO or later. For Juniper Networks Junos OS Evolved versions 21.4 prior to 21.4R3-EVO, update to version 21.4R3-EVO or later. For Juniper Networks Junos OS Evolved versions 22.1 prior to 22.1R3-EVO, update to version 22.1R3-EVO or later. For Juniper Networks Junos OS Evolved versions 22.2 prior to 22.2R3-EVO, update to version 22.2R3-EVO or later.

Fix

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2024-00392

CVE-2024-21613

Affected Products

Junos

Junos Evolved

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-21613 · Security Note
• https://supportportal.juniper.net/JSA75754 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00392 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21613 · Vendor Advisory
• https://first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N · Note