A Heap-based Buffer Overflow vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS).
 

If an attacker sends a specific BGP UPDATE message to the device, this will cause a memory overwrite and therefore an RPD crash and restart in the backup Routing Engine (RE). Continued receipt of these packets will cause a sustained Denial of Service (DoS) condition in the backup RE.

This issue only affects devices with NSR enabled.

Note: NSR is not supported on the SRX Series and is therefore not affected by this vulnerability.
 

The primary RE is not impacted by this issue and there is no impact on traffic.

This issue requires an attacker to have an established BGP session to a system affected by the issue. 
 

This issue affects:

Juniper Networks Junos OS

• All versions earlier than 20.4R3-S9;
• 21.2 versions earlier than 21.2R3-S7;
• 21.3 versions earlier than 21.3R3-S5;
• 21.4 versions earlier than 21.4R3-S5;
• 22.1 versions earlier than 22.1R3-S4;
• 22.2 versions earlier than 22.2R3-S2;
• 22.3 versions earlier than 22.3R3-S1;
• 22.4 versions earlier than 22.4R2-S2, 22.4R3;
• 23.2 versions earlier than 23.2R1-S2, 23.2R2.

Juniper Networks Junos OS Evolved

• All versions earlier than 21.3R3-S5-EVO;
• 21.4-EVO versions earlier than 21.4R3-S5-EVO;
• 22.1-EVO versions earlier than 22.1R3-S4-EVO;
• 22.2-EVO versions earlier than 22.2R3-S2-EVO;
• 22.3-EVO versions later than 22.3R1-EVO;
• 22.4-EVO versions earlier than 22.4R2-S2-EVO, 22.4R3-EVO;
• 23.2-EVO versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO.

The following minimal configuration is required:

To be exposed to this issue non-stop routing (NSR) needs to be configured:

[routing-options nonstop-routing]


Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was seen during production usage.

This issue has been assigned CVE-2024-21596.

The following software releases have been updated to resolve this specific issue:
Junos OS: 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S2, 22.3R3-S1, 22.4R2-S2, 22.4R3, 23.1R2, 23.2R1-S2, 23.2R2, 23.3R1, 23.4R1, and all subsequent releases.
Junos OS Evolved: 21.3R3-S5-EVO, 21.4R3-S5-EVO, 22.1R3-S4-EVO, 22.2R3-S2-EVO, 22.4R2-S2-EVO, 22.4R3-EVO, 23.1R2-EVO, 23.2R1-S2-EVO, 23.2R2-EVO, 23.3R1-EVO, 23.4R1-EVO, and all subsequent releases.

This issue is being tracked as PR 1711727 which is visible on the Customer Support website.

Note: Juniper SIRT's policy [juniper.net] is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

There are no known workarounds for this issue.

2024-01-10: Initial Publication
2024-01-23: Clarified that the SRX Series does not support NSR, and is therefore not affected by this vulnerability

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2024-21596 at cve.mitre.org