PT-2024-28527 · Juniper Networks · Junos

Published 2024-07-10 · Updated 2024-07-11 · CVE-2024-39550

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Junos OS on MX Series with SPC3 line card versions 21.2R3 through 21.2R3-S7 Junos OS on MX Series with SPC3 line card versions 21.4R2 through 21.4R3-S5 Junos OS on MX Series with SPC3 line card versions 22.1 through 22.1R3-S4 Junos OS on MX Series with SPC3 line card versions 22.2 through 22.2R3-S2 Junos OS on MX Series with SPC3 line card versions 22.3 through 22.3R3-S1 Junos OS on MX Series with SPC3 line card versions 22.4 through 22.4R3 Junos OS on MX Series with SPC3 line card versions 23.2 through 23.2R1 Junos OS on MX Series with SPC3 line card versions 23.4 through 23.4R1

Description A Missing Release of Memory after Effective Lifetime issue in the rtlogd process of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, adjacent attacker to trigger internal events, causing a slow memory leak, ultimately leading to a Denial of Service (DoS). The memory usage can be monitored using the command "show system processes extensive | match rtlog".

Recommendations For versions 21.2R3 through 21.2R3-S7, update to version 21.2R3-S8 or later. For versions 21.4R2 through 21.4R3-S5, update to version 21.4R3-S6 or later. For versions 22.1 through 22.1R3-S4, update to version 22.1R3-S5 or later. For versions 22.2 through 22.2R3-S2, update to version 22.2R3-S3 or later. For versions 22.3 through 22.3R3-S1, update to version 22.3R3-S2 or later. For versions 22.4 through 22.4R3, update to version 22.4R3-S1 or later. For versions 23.2 through 23.2R1, update to version 23.2R2 or later. For versions 23.4 through 23.4R1, update to version 23.4R2 or later. As a temporary workaround, consider manually restarting the rtlogd process to recover memory.

Fix

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2025-03718

CVE-2024-39550

Affected Products

Junos

References · 7

• https://supportportal.juniper.net/JSA83012 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39550 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39550 · Security Note
• https://bdu.fstec.ru/vul/2025-03718 · Security Note
• https://twitter.com/VulmonFeeds/status/1811472503941812497 · Twitter Post
• https://t.me/cvedetector/682 · Telegram Post
• https://twitter.com/CVEnew/status/1811440399992455533 · Twitter Post