CVE-2024-21609: Junos OS: MX Series with SPC3, and SRX Series: If specific IPsec parameters are negotiated iked will crash due to a memory leak
First published: Fri Apr 12 2024(Updated: )
A Missing Release of Memory after Effective Lifetime vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an administratively adjacent attacker which is able to successfully establish IPsec tunnels to cause a Denial of Service (DoS). If specific values for the IPsec parameters local-ip, remote-ip, remote ike-id, and traffic selectors are sent from the peer, a memory leak occurs during every IPsec SA rekey which is carried out with a specific message sequence. This will eventually result in an iked process crash and restart. The iked process memory consumption can be checked using the below command: user@host> show system processes extensive | grep iked PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND 56903 root 31 0 4016M 2543M CPU0 0 2:10 10.50% iked This issue affects Juniper Networks Junos OS: * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S4; * 22.1 versions earlier than 22.1R3-S3; * 22.2 versions earlier than 22.2R3-S2; * 22.3 versions earlier than 22.3R3; * 22.4 versions earlier than 22.4R3; * 23.2 versions earlier than 23.2R1-S2, 23.2R2.
Credit: sirt@juniper.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Juniper Junos | <20.4R3-S9<21.2R3-S7<21.3R3-S5<21.4R3-S4<22.1R3-S3<22.2R3-S2<22.3R3<22.4R3<23.2R1-S2<23.2R2 |
Remedy
The following software releases have been updated to resolve this specific issue: 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S4, 22.1R3-S3, 22.2R3-S2, 22.3R3, 22.4R3, 23.2R1-S2, 23.2R2, 23.4R1, and all subsequent releases.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-21609?
CVE-2024-21609 is classified as a moderate severity vulnerability that can lead to a Denial of Service.
How do I fix CVE-2024-21609?
To mitigate CVE-2024-21609, upgrade to the latest patches provided by Juniper Networks for affected versions of Junos OS.
Who is impacted by CVE-2024-21609?
CVE-2024-21609 affects Juniper Networks Junos OS running on MX Series with SPC3 and SRX Series devices.
What type of vulnerability is CVE-2024-21609?
CVE-2024-21609 is a Missing Release of Memory after Effective Lifetime vulnerability.
Can CVE-2024-21609 be exploited remotely?
CVE-2024-21609 can be exploited by an administratively adjacent attacker with the ability to establish IPsec tunnels.
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/event
- agent/remedy
- collector/nvd-api
- source/NVD
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/juniper networks
- canonical/juniper junos