CVE-2024-21598: Juniper Junos BGP DoS Vulnerability

CVE-2024-21598 Overview

CVE-2024-21598 is a denial-of-service vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. The flaw stems from improper validation of syntactic correctness of input [CWE-1286] when parsing tunnel encapsulation attributes in Border Gateway Protocol (BGP) updates. A network-based, unauthenticated attacker can send a malformed type-length-value (TLV) within a tunnel encapsulation attribute over an established BGP session, causing rpd to crash and restart. The issue affects multiple Junos OS and Junos OS Evolved release trains from 20.4 through 23.2. Juniper assigned the issue advisory JSA75739 and notes it is related to but separate from the issue tracked in JSA79095.

Critical Impact

An unauthenticated BGP peer can repeatedly crash the routing daemon, disrupting routing convergence and producing a sustained denial-of-service condition on affected Juniper routers.

Affected Products

• Juniper Networks Junos OS 20.4, 21.2, 21.3, 21.4, 22.1, 22.2, 22.3, 22.4, and 23.2 release trains prior to the fixed service releases
• Juniper Networks Junos OS Evolved 20.4-EVO through 23.2-EVO release trains prior to the fixed service releases
• Routers and routing platforms running rpd with BGP sessions configured for tunnel encapsulation

Discovery Timeline

• 2024-04-12 - CVE-2024-21598 published to NVD
• 2025-02-06 - Last updated in NVD database

Technical Details for CVE-2024-21598

Vulnerability Analysis

The Routing Protocol Daemon (rpd) on Junos OS and Junos OS Evolved processes BGP UPDATE messages, including optional path attributes such as the tunnel encapsulation attribute defined in RFC 9012. This attribute contains a sequence of TLV sub-structures describing tunnel parameters. The vulnerable code does not adequately validate the syntactic correctness of these TLVs before processing them. When rpd parses a specifically malformed TLV, the daemon crashes and restarts. Because BGP sessions are typically long-lived and persistent, an attacker that can deliver a single crafted UPDATE will trigger repeated daemon restarts, preventing route processing and disrupting network reachability for the affected device.

Root Cause

The underlying weakness is classified as Improper Validation of Syntactic Correctness of Input [CWE-1286]. The tunnel encapsulation attribute parser in rpd fails to verify TLV length and structure constraints before dereferencing or processing fields. Malformed input drives the parser into an unexpected state that terminates the process. The defect is isolated to the BGP attribute parsing path and does not affect Junos OS releases earlier than 20.4R1 or Junos OS Evolved releases earlier than 20.4R1-EVO.

Attack Vector

Exploitation requires an established BGP session with the target device, which the attacker either controls directly as a configured peer or reaches through a compromised upstream peer that propagates the malformed attribute. No authentication beyond the existing BGP peering and no user interaction is required. Once the crafted BGP UPDATE traverses the session, rpd crashes; repeated transmission yields a sustained denial-of-service condition affecting routing on the device.

No public proof-of-concept exploit code is available for this issue. See the Juniper Security Advisory JSA75739 for vendor technical details.

Detection Methods for CVE-2024-21598

Indicators of Compromise

• Unexpected rpd process crashes or restarts logged in /var/log/messages or in show system core-dumps output
• BGP sessions repeatedly flapping or transitioning through Idle, Connect, and Established states without configuration change
• Core files generated by the rpd daemon coincident with receipt of BGP UPDATE traffic
• Syslog entries referencing rpd signal termination or assertion failures during BGP attribute processing

Detection Strategies

• Correlate rpd crash events with inbound BGP UPDATE timestamps from specific peers to identify the source of malformed attributes
• Inspect BGP UPDATE messages on peering interfaces for tunnel encapsulation attribute (attribute type 23) TLVs with anomalous length fields
• Monitor for BGP session resets across multiple peers occurring near-simultaneously, indicating possible upstream propagation of a malformed attribute

Monitoring Recommendations

• Forward Junos syslog and rpd crash telemetry to a centralized logging or SIEM platform for alerting on daemon restart patterns
• Enable BGP trace options selectively to capture attribute parsing errors when investigating suspected exploitation
• Track per-peer UPDATE statistics with show bgp neighbor and alert on abnormal volumes of attribute parsing errors

How to Mitigate CVE-2024-21598

Immediate Actions Required

• Upgrade affected devices to a fixed Junos OS or Junos OS Evolved release as listed in Juniper Security Advisory JSA75739
• Audit BGP peering configurations and confirm that only trusted neighbors are permitted to establish sessions
• Apply BGP import policies that filter or reject tunnel encapsulation attributes from peers that do not require them
• Review device crash logs to determine whether rpd instability already correlates with this issue

Patch Information

Juniper has released fixed software in the following service releases: Junos OS 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S3, 22.3R3-S1, 22.4R3, 23.2R1-S2, 23.2R2, and all subsequent releases. Equivalent fixes apply to the corresponding Junos OS Evolved trains (for example, 20.4R3-S9-EVO and 23.2R1-S2-EVO). Refer to Juniper Security Advisory JSA75739 for the complete and authoritative fixed-release matrix.

Workarounds

• Restrict BGP peering to trusted, authenticated neighbors using configured peer addresses and BGP authentication
• Apply BGP import policies that discard or sanitize tunnel encapsulation attributes from peers that do not require them
• Use infrastructure access control lists to limit BGP TCP/179 connectivity to known peer addresses
• Where tunnel encapsulation signaling is not required, disable or avoid configurations that process the attribute

# Example Junos import policy to reject UPDATEs carrying the tunnel encapsulation attribute
# from peers that do not require it. Review against operational requirements before deployment.
set policy-options policy-statement REJECT-TUNNEL-ENCAP term match-tunnel-encap from attribute tunnel-encapsulation
set policy-options policy-statement REJECT-TUNNEL-ENCAP term match-tunnel-encap then reject
set protocols bgp group EXTERNAL import REJECT-TUNNEL-ENCAP
commit check