CVE-2024-21587: Junos OS: MX Series: Memory leak in bbe-smgd process if BFD liveness detection for DHCP subscribers is enabled
An Improper Handling of Exceptional Conditions vulnerability in the broadband edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an attacker directly connected to the vulnerable system who repeatedly flaps DHCP subscriber sessions to cause a slow memory leak, ultimately leading to a Denial of Service (DoS). Memory can only be recovered by manually restarting bbe-smgd.
This issue only occurs if BFD liveness detection for DHCP subscribers is enabled. Systems without BFD liveness detection enabled are not vulnerable to this issue.
Indication of the issue can be observed by periodically executing the 'show system processes extensive' command, which will indicate an increase in memory allocation for bbe-smgd. A small amount of memory is leaked every time a DHCP subscriber logs in, which will become visible over time, ultimately leading to memory starvation.
user@junos> show system processes extensive | match bbe-smgd 13071 root 24 0 415M 201M select 0 0:41 7.28% bbe-smgd{bbe-smgd} 13071 root 20 0 415M 201M select 1 0:04 0.00% bbe-smgd{bbe-smgd} ... user@junos> show system processes extensive | match bbe-smgd 13071 root 20 0 420M 208M select 0 4:33 0.10% bbe-smgd{bbe-smgd} 13071 root 20 0 420M 208M select 0 0:12 0.00% bbe-smgd{bbe-smgd} ... This issue affects Juniper Networks Junos OS on MX Series:
All versions earlier than 20.4R3-S9; 21.2 versions earlier than 21.2R3-S7; 21.3 versions earlier than 21.3R3-S5; 21.4 versions earlier than 21.4R3-S5; 22.1 versions earlier than 22.1R3-S4; 22.2 versions earlier than 22.2R3-S3; 22.3 versions earlier than 22.3R3-S2; 22.4 versions earlier than 22.4R2-S2, 22.4R3; 23.2 versions earlier than 23.2R1-S1, 23.2R2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 20.4R3-S9 - Upgrade
Upgrade
Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 21.2R3-S7 - Upgrade
Upgrade
Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 21.3R3-S5 - Upgrade
Upgrade
Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 21.4R3-S5 - Upgrade
Upgrade
Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 22.1R3-S4 - Upgrade
Upgrade
Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 22.2R3-S3 - Upgrade
Upgrade
Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 22.3R3-S2 - Upgrade
Upgrade
Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 22.4R2-S2 - Upgrade
Upgrade
Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 22.4R3 - Upgrade
Upgrade
Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 23.2R1-S1 - Upgrade
Upgrade
Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 23.2R2 - Upgrade
Upgrade
Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 23.4R1 - Configuration
Disable BFD liveness detection for DHCP subscribers, since the memory leak only occurs when BFD liveness detection is enabled.
Junos OS (MX Series) broadband edge subscriber management daemon (bbe-smgd) BFD liveness detection for DHCP subscribers = disabled - Operational
If memory starvation begins due to the leak, manually restart bbe-smgd to recover memory.
- Operational
Periodically run 'show system processes extensive' and check for bbe-smgd to confirm the issue (expect increasing memory allocation for bbe-smgd over time).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21587?
The severity of CVE-2024-21587 is classified as high due to its potential to allow unauthorized attackers to disrupt services by flapping DHCP subscriber sessions.
How do I fix CVE-2024-21587?
To fix CVE-2024-21587, it is recommended to update the Junos OS to the latest patched version provided by Juniper Networks.
What systems are affected by CVE-2024-21587?
CVE-2024-21587 affects specific versions of Junos OS on MX Series devices, particularly versions 20.4 and 21.x.
Can CVE-2024-21587 be exploited remotely?
No, CVE-2024-21587 requires an attacker to be directly connected to the vulnerable MX device to exploit the vulnerability.
What is the impact of CVE-2024-21587 if exploited?
If exploited, CVE-2024-21587 can cause service disruptions by repeatedly disconnecting and reconnecting DHCP subscriber sessions.