CVE-2024-21611

A Missing Release of Memory after Effective Lifetime vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).

In a Juniper Flow Monitoring (jflow) scenario route churn that causes BGP next hops to be updated will cause a slow memory leak and eventually a crash and restart of rpd.

Thread level memory utilization for the areas where the leak occurs can be checked using the below command:

user@host> show task memory detail | match so_in so_in6 28 32 344450 11022400 344760 11032320 so_in 8 16 1841629 29466064 1841734 29467744 This issue affects:

Junos OS

21.4 versions earlier than 21.4R3;
22.1 versions earlier than 22.1R3;
22.2 versions earlier than 22.2R3.

Junos OS Evolved

21.4-EVO versions earlier than 21.4R3-EVO;
22.1-EVO versions earlier than 22.1R3-EVO;
22.2-EVO versions earlier than 22.2R3-EVO.

This issue does not affect:

Juniper Networks Junos OS versions earlier than 21.4R1.

Juniper Networks Junos OS Evolved versions earlier than 21.4R1.

Weakness

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

Affected Software

Name	Vendor	Start Version	End Version
Junos	Juniper	21.4 (including)	21.4 (including)
Junos	Juniper	21.4-r1 (including)	21.4-r1 (including)
Junos	Juniper	21.4-r1-s1 (including)	21.4-r1-s1 (including)
Junos	Juniper	21.4-r1-s2 (including)	21.4-r1-s2 (including)
Junos	Juniper	21.4-r2 (including)	21.4-r2 (including)
Junos	Juniper	21.4-r2-s1 (including)	21.4-r2-s1 (including)
Junos	Juniper	21.4-r2-s2 (including)	21.4-r2-s2 (including)
Junos	Juniper	22.1 (including)	22.1 (including)
Junos	Juniper	22.1-r1 (including)	22.1-r1 (including)
Junos	Juniper	22.1-r1-s1 (including)	22.1-r1-s1 (including)
Junos	Juniper	22.1-r1-s2 (including)	22.1-r1-s2 (including)
Junos	Juniper	22.1-r2 (including)	22.1-r2 (including)
Junos	Juniper	22.1-r2-s1 (including)	22.1-r2-s1 (including)
Junos	Juniper	22.1-r2-s2 (including)	22.1-r2-s2 (including)
Junos	Juniper	22.2 (including)	22.2 (including)
Junos	Juniper	22.2-r1 (including)	22.2-r1 (including)
Junos	Juniper	22.2-r1-s1 (including)	22.2-r1-s1 (including)
Junos	Juniper	22.2-r1-s2 (including)	22.2-r1-s2 (including)
Junos	Juniper	22.2-r2 (including)	22.2-r2 (including)
Junos	Juniper	22.2-r2-s1 (including)	22.2-r2-s1 (including)
Junos	Juniper	22.2-r2-s2 (including)	22.2-r2-s2 (including)

Potential Mitigations

Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
For example, glibc in Linux provides protection against free of invalid pointers.
When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.

NVD	https://nvd.nist.gov/vuln/detail/CVE-2024-21611
CWE	https://cwe.mitre.org/data/definitions/401.html

Missing Release of Memory after Effective Lifetime

Weakness

Affected Software

Potential Mitigations

References