An Improper Validation of Syntactic Correctness of Input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS).

If an attacker sends high rate of specific ICMP traffic to a device with VXLAN configured, this causes a deadlock of the PFE and results in the device becoming unresponsive. A manual restart will be required to recover the device.

This issue only affects EX4100, EX4400, EX4600 and QFX5000 Series devices.

This issue affects:

Juniper Networks Junos OS

21.4R3 versions earlier than 21.4R3-S4;

22.1R3 versions earlier than 22.1R3-S3;

22.2R2 versions earlier than 22.2R3-S1;

22.3 versions earlier than 22.3R2-S2, 22.3R3;

22.4 versions earlier than 22.4R2;

23.1 versions earlier than 23.1R2.

To be exposed to this issue the device needs be configured for VXLAN with either of the following statements:

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was seen during production usage.

This issue has been assigned CVE-2024-21595.

The following software releases have been updated to resolve this specific issue: 21.4R3-S4, 22.1R3-S3, 22.2R3-S1, 22.3R2-S2, 22.3R3, 22.4R2, 23.1R2, 23.2R1, and all subsequent releases.

This issue is being tracked as PR 1719542 which is visible on the Customer Support website.

Note: Juniper SIRT's policy [juniper.net] is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

There are no known workarounds for this issue.

2024-01-10: Initial Publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2024-21595 at cve.mitre.org