CVE-2024-21606: Juniper Junos SRX Series DoS Vulnerability

CVE-2024-21606 Overview

CVE-2024-21606 is a Double Free vulnerability [CWE-415] in the flow processing daemon (flowd) of Juniper Networks Junos OS running on SRX Series firewalls. An unauthenticated, network-based attacker can trigger a flowd crash and restart by sending a specific sequence of packets when a tcp-encap-profile is configured in a remote access VPN scenario. Repeated exploitation results in a sustained Denial of Service (DoS) on the affected firewall. The vulnerability affects a broad range of SRX Series platforms and multiple Junos OS release trains from 20.4 through 22.4.

Critical Impact
A remote unauthenticated attacker can repeatedly crash the flowd process on SRX Series firewalls, disrupting traffic forwarding and VPN services.

Affected Products

Juniper Networks Junos OS on SRX Series, all versions earlier than 20.4R3-S8
Junos OS 21.2 versions earlier than 21.2R3-S6, 21.3 versions earlier than 21.3R3-S5, 21.4 versions earlier than 21.4R3-S5
Junos OS 22.1 versions earlier than 22.1R3-S3, 22.2 versions earlier than 22.2R3-S3, 22.3 versions earlier than 22.3R3-S1, 22.4 versions earlier than 22.4R2-S2 or 22.4R3

Discovery Timeline

2024-01-12 - CVE-2024-21606 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21606

Vulnerability Analysis

The flow processing daemon (flowd) is the central data-plane process on SRX Series firewalls. It is responsible for session management, packet forwarding, NAT, and security policy enforcement. A Double Free condition in flowd allows the same heap allocation to be released twice, corrupting the memory allocator's internal state and causing the process to abort. When flowd crashes, the data plane restarts and active traffic, including IPsec tunnels and remote access VPN sessions, is disrupted until services recover. An attacker who can repeat the triggering packet sequence can produce a sustained service outage.

Root Cause

The root cause is improper memory management within the flowd code path that handles the tcp-encap-profile feature used by remote access VPN. A specific packet sequence drives flowd into a state where a heap buffer is freed and then freed again [CWE-415]. The defect is only reachable when tcp-encap-profile is configured on the device, making the vulnerable surface configuration-dependent rather than universal.

Attack Vector

Exploitation requires only network reachability to the SRX firewall and a configuration that includes a tcp-encap-profile. The attacker does not need credentials or user interaction. By crafting and sending the specific TCP-encapsulated packet sequence to the remote access VPN endpoint, the attacker triggers the double free in flowd and forces a crash and restart. No code execution or data disclosure is associated with this issue; impact is limited to availability.

No public proof-of-concept exploit has been published for CVE-2024-21606 at the time of writing, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-21606

Indicators of Compromise

Unexpected flowd process crashes, core files, or restart events recorded in Junos OS system logs (/var/log/messages, chassisd, eventd).
Repeated traffic interruptions correlated with inbound TCP traffic to remote access VPN endpoints using tcp-encap-profile.
SNMP traps or NETCONF notifications indicating data plane restarts on SRX Series devices.

Detection Strategies

Audit Junos OS configurations for the presence of tcp-encap-profile statements under the remote access VPN hierarchy and inventory devices that match vulnerable release trains.
Correlate firewall syslog events showing flowd termination with external network telemetry to identify packet sources preceding the crash.
Forward Junos OS logs to a centralized SIEM and alert on patterns of recurring flowd core dumps from the same management cluster.

Monitoring Recommendations

Enable structured syslog forwarding from all SRX devices and monitor for RPD_DAEMON_TERMINATED, flowd core, and session table reset events.
Track NetFlow or sFlow drops and session table resets that coincide with inbound traffic to VPN listeners.
Baseline normal flowd uptime and alert on unexpected restart intervals across the SRX fleet.

How to Mitigate CVE-2024-21606

Immediate Actions Required

Identify all SRX Series devices running Junos OS releases listed as affected and prioritize patching of internet-facing firewalls that terminate remote access VPN traffic.
Review configurations for tcp-encap-profile usage; devices without this configuration are not exposed to this specific issue.
Restrict source addresses permitted to reach the remote access VPN endpoint where operationally feasible until patches are applied.

Patch Information

Juniper Networks has released fixed software in Junos OS 20.4R3-S8, 21.2R3-S6, 21.3R3-S5, 21.4R3-S5, 22.1R3-S3, 22.2R3-S3, 22.3R3-S1, 22.4R2-S2, 22.4R3, and all subsequent releases. Refer to the Juniper Security Advisory JSA75747 for full version guidance and download links.

Workarounds

Remove the tcp-encap-profile configuration if the feature is not required for production remote access VPN operation.
Apply firewall filters upstream of the SRX to restrict TCP encapsulation traffic to known, trusted client networks.
Maintain redundant SRX cluster members so that a flowd crash on one node fails over to a healthy peer while patches are deployed.

bash

# Inspect Junos configuration for vulnerable tcp-encap-profile usage
show configuration security tcp-encap | display set

# Verify current Junos OS version against fixed releases in JSA75747
show version | match Junos