CVE-2024-21612: Junos OS Evolved: Specific TCP traffic causes OFP core and restart of RE
An Improper Handling of Syntactically Invalid Structure vulnerability in Object Flooding Protocol (OFP) service of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).
On all Junos OS Evolved platforms, when specific TCP packets are received on an open OFP port, the OFP crashes leading to a restart of Routine Engine (RE). Continuous receipt of these specific TCP packets will lead to a sustained Denial of Service (DoS) condition.
This issue affects:
Juniper Networks Junos OS Evolved
All versions earlier than 21.2R3-S7-EVO; 21.3 versions earlier than 21.3R3-S5-EVO ; 21.4 versions earlier than 21.4R3-S5-EVO; 22.1 versions earlier than 22.1R3-S4-EVO; 22.2 versions earlier than 22.2R3-S3-EVO ; 22.3 versions earlier than 22.3R3-EVO; 22.4 versions earlier than 22.4R2-EVO, 22.4R3-EVO.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 21.2R3-S7-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 21.3R3-S5-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 21.4R3-S5-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 22.1R3-S4-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 22.2R3-S3-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 22.3R3-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 22.4R2-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 22.4R3-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 23.2R1-EVO - Compensating control
Mitigate the Denial of Service by preventing the specific TCP packets from reaching an open OFP port on Junos OS Evolved platforms (e.g., restrict/close access to the OFP port so that attack traffic cannot be received).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21612?
CVE-2024-21612 has been classified as a High severity vulnerability due to its potential to cause a Denial of Service.
How do I fix CVE-2024-21612?
To address CVE-2024-21612, upgrade to Junos OS Evolved version 21.2 or later, as per the vendor's recommendations.
What can an attacker do with CVE-2024-21612?
An unauthenticated, network-based attacker can exploit CVE-2024-21612 to induce a Denial of Service on affected systems.
Which Juniper Networks products are affected by CVE-2024-21612?
CVE-2024-21612 affects all Junos OS Evolved platforms prior to version 21.2.
Is there a workaround for CVE-2024-21612?
Currently, there are no specific workarounds available for CVE-2024-21612, and upgrading is recommended for mitigation.