CVE-2024-21617: Junos OS: BGP flap on NSR-enabled devices causes memory leak
An Incomplete Cleanup vulnerability in Nonstop active routing (NSR) component of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause memory leak leading to Denial of Service (DoS).
On all Junos OS platforms, when NSR is enabled, a BGP flap will cause memory leak. A manual reboot of the system will restore the services.
Note: NSR is not supported on the SRX Series and is therefore not affected by this vulnerability. The memory usage can be monitored using the below commands.
user@host> show chassis routing-engine no-forwarding user@host> show system memory | no-more This issue affects:
Juniper Networks Junos OS
21.2 versions earlier than 21.2R3-S5; 21.3 versions earlier than 21.3R3-S4; 21.4 versions earlier than 21.4R3-S4; 22.1 versions earlier than 22.1R3-S2; 22.2 versions earlier than 22.2R3-S2; 22.3 versions earlier than 22.3R2-S1, 22.3R3; 22.4 versions earlier than 22.4R1-S2, 22.4R2.
This issue does not affect Junos OS versions earlier than 20.4R3-S7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 21.2R3-S5 - Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 21.3R3-S4 - Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 21.4R3-S4 - Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 22.1R3-S2 - Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 22.2R3-S2 - Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 22.3R2-S1 - Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 22.3R3 - Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 22.4R1-S2 - Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 22.4R2 - Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 23.2R1 - Compensating control
On NSR-enabled Junos OS devices, avoid BGP flaps while running a release that is earlier than the updated fixed releases; NSR is not supported on the SRX Series and is therefore not affected by this vulnerability.
- Operational
After occurrence/mitigation, perform a manual reboot of the system to restore the services.
- Operational
Monitor memory usage on the routing engine using: 'show chassis routing-engine no-forwarding' and 'show system memory | no-more'.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21617?
CVE-2024-21617 is classified as having a high severity due to its ability to cause a Denial of Service (DoS).
How do I fix CVE-2024-21617?
To mitigate CVE-2024-21617, upgrade to the latest patched version of Junos OS as recommended by Juniper Networks.
Which versions of Junos OS are affected by CVE-2024-21617?
CVE-2024-21617 affects multiple versions of Junos OS, including 21.2, 21.3, 21.4, 22.1, 22.2, and 22.3.
Can CVE-2024-21617 be exploited remotely?
Yes, CVE-2024-21617 can be exploited by an adjacent, unauthenticated attacker.
What impact does CVE-2024-21617 have on system performance?
CVE-2024-21617 can lead to a memory leak which significantly degrades system performance and may cause a Denial of Service.