CVE-2024-21594: Junos OS: SRX 5000 Series: Repeated execution of a specific CLI command causes a flowd crash
A Heap-based Buffer Overflow vulnerability in the Network Services Daemon (NSD) of Juniper Networks Junos OS allows authenticated, low privileged, local attacker to cause a Denial of Service (DoS).
On an SRX 5000 Series device, when executing a specific command repeatedly, memory is corrupted, which leads to a Flow Processing Daemon (flowd) crash.
The NSD process has to be restarted to restore services.
If this issue occurs, it can be checked with the following command:
user@host> request security policies check The following log message can also be observed:
Error: policies are out of sync for PFE node<number>.fpc<number>.pic<number>. This issue affects:
Juniper Networks Junos OS on SRX 5000 Series
All versions earlier than 20.4R3-S6; 21.1 versions earlier than 21.1R3-S5; 21.2 versions earlier than 21.2R3-S4; 21.3 versions earlier than 21.3R3-S3; 21.4 versions earlier than 21.4R3-S3; 22.1 versions earlier than 22.1R3-S1; 22.2 versions earlier than 22.2R3; 22.3 versions earlier than 22.3R2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.4R3-S6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 21.1R3-S5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 21.2R3-S4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 21.3R3-S3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 21.4R3-S3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.1R3-S1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.2R3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.3R2 - Operational
If the issue occurs, restart the NSD process to restore services.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21594?
CVE-2024-21594 is rated as a medium severity vulnerability due to its potential to cause Denial of Service (DoS) for authenticated, low privileged local attackers.
How do I fix CVE-2024-21594?
To mitigate CVE-2024-21594, it is recommended to update Junos OS to the latest patched version that addresses this vulnerability.
What systems are affected by CVE-2024-21594?
CVE-2024-21594 impacts various versions of Juniper Networks Junos OS, particularly the SRX 5000 Series devices running affected software versions up to 22.3.
Can CVE-2024-21594 be exploited remotely?
CVE-2024-21594 requires local access for exploitation, as an authenticated low privileged local attacker needs to execute a specific command.
What are the potential impacts of CVE-2024-21594?
The primary impact of CVE-2024-21594 is a Denial of Service (DoS), leading to service disruption on affected devices.