CVE-2024-21595: Juniper Junos PFE DoS Vulnerability

CVE-2024-21595 Overview

CVE-2024-21595 is a denial of service vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS. The flaw stems from improper validation of syntactic correctness of input [CWE-1286] and affects EX4100, EX4400, EX4600, and QFX5000 Series devices configured with Virtual Extensible LAN (VXLAN). A network-based, unauthenticated attacker can trigger a deadlock in the PFE by sending a high rate of specific Internet Control Message Protocol (ICMP) traffic to an affected device. Successful exploitation renders the device unresponsive and requires a manual restart to recover.

Critical Impact
Unauthenticated remote attackers can take VXLAN-enabled Juniper switches offline through crafted ICMP floods, requiring manual restart to restore service.

Affected Products

Juniper Networks Junos OS on EX4100, EX4400, EX4600 Series switches
Juniper Networks Junos OS on QFX5000 Series (QFX5100, QFX5110, QFX5120, QFX5130, QFX5200, QFX5210, QFX5220, QFX5700)
Junos OS versions: 21.4R3 prior to 21.4R3-S4; 22.1R3 prior to 22.1R3-S3; 22.2R2 prior to 22.2R3-S1; 22.3 prior to 22.3R2-S2/22.3R3; 22.4 prior to 22.4R2; 23.1 prior to 23.1R2

Discovery Timeline

2024-01-12 - CVE-2024-21595 published to the National Vulnerability Database (NVD)
2024-01-12 - Juniper publishes security advisory JSA75734
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21595

Vulnerability Analysis

The vulnerability resides in the Packet Forwarding Engine (PFE), the data-plane component responsible for line-rate packet processing on Juniper EX and QFX hardware. When VXLAN is configured on an affected switch, the PFE fails to properly validate the syntactic correctness of specific ICMP packets traversing the device. A sustained, high-rate flow of these crafted ICMP packets causes the PFE to enter a deadlock state. Once deadlocked, the device stops forwarding traffic and becomes unresponsive on both the data and management planes. Recovery requires a manual restart, since no automatic watchdog or self-healing mechanism resolves the condition.

Root Cause

The root cause is classified under [CWE-1286] — Improper Validation of Syntactic Correctness of Input. The PFE's ICMP handling logic on VXLAN-enabled platforms does not adequately validate packet structure before processing. Under high packet rates, this missing validation leads to contention on internal PFE resources, producing a deadlock between processing threads or hardware queues.

Attack Vector

Exploitation requires only network reachability to the targeted device. No authentication, user interaction, or elevated privileges are needed. The attacker sends a sustained flood of specific ICMP traffic toward the VXLAN-configured switch. The vulnerability impacts only availability — confidentiality and integrity remain intact — but the loss of forwarding on a data-center top-of-rack switch can cascade across attached workloads. Devices without VXLAN configuration are not affected.

No public proof-of-concept exploit, ExploitDB entry, or CISA Known Exploited Vulnerabilities Catalog listing exists for CVE-2024-21595 at the time of writing. Refer to the Juniper Security Advisory JSA75734 for vendor-provided technical details.

Detection Methods for CVE-2024-21595

Indicators of Compromise

Sudden unresponsiveness of EX4100, EX4400, EX4600, or QFX5000 Series switches with VXLAN configured, requiring manual restart
Sustained, abnormally high ingress ICMP packet rates targeting management or transit interfaces of VXLAN-enabled switches
PFE process hangs, traffic blackholes, or lost connectivity to overlay endpoints preceding device hang

Detection Strategies

Monitor PFE health and CPU/queue utilization on affected platforms using Junos telemetry (show pfe statistics traffic, JTI/gNMI streaming, or SNMP)
Baseline normal ICMP volumes at network edges and alert on sustained ICMP rate anomalies directed at fabric switches
Correlate switch reachability loss with upstream ICMP traffic spikes in network detection and response or NetFlow tooling

Monitoring Recommendations

Forward Junos syslog and streaming telemetry to a centralized analytics platform to identify PFE-level anomalies in real time
Enable port mirroring or sFlow on uplinks to data-center fabric switches to retain traffic samples for post-incident analysis
Track device uptime and unexpected reboots across the EX/QFX fleet to surface candidate exploitation events

How to Mitigate CVE-2024-21595

Immediate Actions Required

Inventory all EX4100, EX4400, EX4600, and QFX5000 Series devices and identify those running affected Junos OS releases with VXLAN configured
Upgrade Junos OS to a fixed release listed in JSA75734 as soon as a maintenance window permits
Apply control-plane and edge ICMP rate-limiting to reduce exposure to ICMP-based floods until patches are deployed

Patch Information

Juniper Networks has released fixed versions in Junos OS 21.4R3-S4, 22.1R3-S3, 22.2R3-S1, 22.3R2-S2, 22.3R3, 22.4R2, 23.1R2, and all subsequent releases. Full version mapping and download links are available in the Juniper Security Advisory JSA75734.

Workarounds

Apply ICMP rate-limiting through firewall filters or policers on ingress interfaces of affected switches to constrain ICMP throughput
Restrict ICMP traffic at network perimeters and between security zones so that only required ICMP types reach fabric switches
Where VXLAN is not required on an affected device, remove the VXLAN configuration to eliminate the exposed code path

bash

# Example Junos firewall filter to police inbound ICMP and mitigate exposure
set firewall policer ICMP-POLICER if-exceeding bandwidth-limit 1m
set firewall policer ICMP-POLICER if-exceeding burst-size-limit 15k
set firewall policer ICMP-POLICER then discard
set firewall family inet filter LIMIT-ICMP term icmp from protocol icmp
set firewall family inet filter LIMIT-ICMP term icmp then policer ICMP-POLICER
set firewall family inet filter LIMIT-ICMP term icmp then accept
set firewall family inet filter LIMIT-ICMP term default then accept
set interfaces <interface> unit 0 family inet filter input LIMIT-ICMP