CVE-2024-21604: Juniper Junos OS Evolved DoS Vulnerability

CVE-2024-21604 Overview

CVE-2024-21604 is a resource allocation flaw in the kernel of Juniper Networks Junos OS Evolved. An unauthenticated, network-based attacker can trigger a Denial of Service (DoS) by sending a high rate of specific valid packets to the routing engine (RE). The condition causes the connection-tracking table to fill, leading to dropped packets and loss of connectivity between the RE and other chassis components. The result is a complete and persistent system outage that requires intervention to restore. The flaw is tracked as [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
Remote attackers without authentication can cause a persistent outage of the routing engine, disrupting all routing operations on affected chassis.

Affected Products

Juniper Junos OS Evolved — all versions earlier than 20.4R3-S7-EVO
Juniper Junos OS Evolved 21.2-EVO, 21.4-EVO (before 21.4R3-S5-EVO), 22.1-EVO (before 22.1R3-S2-EVO)
Juniper Junos OS Evolved 22.2-EVO (before 22.2R3-EVO), 22.3-EVO (before 22.3R2-EVO), 22.4-EVO (before 22.4R2-EVO)

Discovery Timeline

2024-01-12 - CVE-2024-21604 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21604

Vulnerability Analysis

The vulnerability lives in the kernel's connection-tracking subsystem on Junos OS Evolved. When the routing engine processes a sustained, high rate of specific valid packets, the nf_conntrack table reaches capacity. Once full, the kernel begins dropping packets and logs the following message:

<host> kernel: nf_conntrack: nf_conntrack: table full, dropping packet

Because the RE relies on intra-chassis communication for control-plane operations, table exhaustion severs the RE from line cards and other chassis components. This is not a transient slowdown — the outage persists until the condition is cleared.

Root Cause

The kernel does not enforce sufficient limits or throttling on the resources consumed when processing specific packet flows directed at the routing engine. There is no upper bound or rate-limiting in place to prevent the connection-tracking state table from being exhausted by attacker-controlled traffic.

Attack Vector

An unauthenticated remote attacker reachable over the network can send a sustained stream of valid packets targeting the RE. No credentials, user interaction, or special access are required. Operators who configure a carefully designed lo0 (loopback) firewall filter to block or rate-limit these packets can prevent the condition from occurring. See the Juniper Security Advisory JSA75745 for the full traffic profile and configuration guidance.

Detection Methods for CVE-2024-21604

Indicators of Compromise

Repeated kernel log entries containing nf_conntrack: nf_conntrack: table full, dropping packet on the routing engine.
Loss of connectivity between the RE and other chassis components, including line card disconnects.
Sudden spikes in inbound packet rate to the RE control plane from a small set of source addresses.

Detection Strategies

Monitor kernel logs on Junos OS Evolved devices for nf_conntrack table-full messages and forward them to a central log aggregator.
Baseline normal control-plane traffic rates and alert on sustained deviations directed at the routing engine.
Track chassis component health metrics and alarm on RE-to-line-card communication failures.

Monitoring Recommendations

Ingest Junos OS Evolved syslog into a SIEM or log analytics platform and create rules keyed on nf_conntrack and chassis disconnect events.
Use SNMP and streaming telemetry to track conntrack table utilization and RE CPU load over time.
Correlate sustained high packet-per-second rates against the RE with the appearance of conntrack table-full log entries.

How to Mitigate CVE-2024-21604

Immediate Actions Required

Inventory all Junos OS Evolved devices and identify versions older than the fixed releases listed in JSA75745.
Apply the vendor-supplied fixed release as soon as a maintenance window allows.
Deploy a lo0 firewall filter to block or rate-limit the traffic profile described in the Juniper advisory until patches are installed.

Patch Information

Juniper has released fixed software in 20.4R3-S7-EVO, 21.4R3-S5-EVO, 22.1R3-S2-EVO, 22.2R3-EVO, 22.3R2-EVO, 22.4R2-EVO, and all subsequent releases. Refer to the Juniper Security Advisory JSA75745 for the complete fixed-version matrix and upgrade procedure.

Workarounds

Configure a lo0 firewall filter that blocks or rate-limits the specific packets identified in the Juniper advisory before they reach the routing engine.
Restrict management and control-plane reachability to trusted networks using infrastructure ACLs at the network edge.
Apply control-plane policing to enforce hard limits on packet rates destined for the RE.

bash

# Example lo0 firewall filter applied to the loopback to rate-limit
# traffic to the routing engine on Junos OS Evolved.
# Adapt match conditions to the traffic profile in JSA75745.
set firewall family inet filter protect-re term limit-suspect from protocol <protocol>
set firewall family inet filter protect-re term limit-suspect then policer re-policer
set firewall family inet filter protect-re term default then accept
set firewall policer re-policer if-exceeding bandwidth-limit 1m burst-size-limit 15k
set firewall policer re-policer then discard
set interfaces lo0 unit 0 family inet filter input protect-re