An Improper Handling of Exceptional Conditions vulnerability in the broadband edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an attacker directly connected to the vulnerable system who repeatedly flaps DHCP subscriber sessions to cause a slow memory leak, ultimately leading to a Denial of Service (DoS). Memory can only be recovered by manually restarting bbe-smgd.
 

This issue only occurs if BFD liveness detection for DHCP subscribers is enabled. Systems without BFD liveness detection enabled are not vulnerable to this issue.
 

Indication of the issue can be observed by periodically executing the 'show system processes extensive' command, which will indicate an increase in memory allocation for bbe-smgd. A small amount of memory is leaked every time a DHCP subscriber logs in, which will become visible over time, ultimately leading to memory starvation.
 

This issue affects Juniper Networks Junos OS on MX Series:

• All versions earlier than 20.4R3-S9;
• 21.2 versions earlier than 21.2R3-S7;
• 21.3 versions earlier than 21.3R3-S5;
• 21.4 versions earlier than 21.4R3-S5;
• 22.1 versions earlier than 22.1R3-S4;
• 22.2 versions earlier than 22.2R3-S3;
• 22.3 versions earlier than 22.3R3-S2;
• 22.4 versions earlier than 22.4R2-S2, 22.4R3;
• 23.2 versions earlier than 23.2R1-S1, 23.2R2.

DHCP liveness detection is enabled and configured as follows:

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was seen during production usage.

This issue has been assigned CVE-2024-21587.
 

The following software releases have been updated to resolve this specific issue: Junos OS 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S3, 22.3R3-S2, 22.4R2-S2, 22.4R3, 23.2R1-S1, 23.2R2, 23.4R1, and all subsequent releases.
 

This issue is being tracked as PR 1734564 which is visible on the Customer Support website.
 

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).
 

This issue can be mitigated by disabling BFD liveness detection for DHCP subscribers.
 

Service can be restored by manually restarting the bbe-smgd process periodically.
 

2024-01-10: Initial Publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2024-21587 at cve.mitre.org