CVE-2024-21611 Overview
CVE-2024-21611 is a memory leak vulnerability [CWE-401] in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated, network-based attacker can trigger a Denial of Service (DoS) by inducing BGP next-hop churn in a Juniper Flow Monitoring (jflow) scenario. Continuous route updates cause a slow memory leak in rpd that eventually crashes and restarts the daemon, disrupting routing on affected devices. The vulnerability affects Junos OS and Junos OS Evolved releases 21.4, 22.1, and 22.2 prior to their respective R3 fixes.
Critical Impact
Unauthenticated remote attackers can crash the routing protocol daemon, causing routing instability and network outages on affected Juniper devices.
Affected Products
- Juniper Networks Junos OS 21.4 versions earlier than 21.4R3, 22.1 versions earlier than 22.1R3, and 22.2 versions earlier than 22.2R3
- Juniper Networks Junos OS Evolved 21.4-EVO versions earlier than 21.4R3-EVO, 22.1-EVO versions earlier than 22.1R3-EVO, and 22.2-EVO versions earlier than 22.2R3-EVO
- Configurations using Juniper Flow Monitoring (jflow) with BGP
Discovery Timeline
- 2024-01-12 - CVE-2024-21611 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2024-21611
Vulnerability Analysis
The vulnerability resides in the Routing Protocol Daemon (rpd) that handles routing protocols including BGP in Junos OS and Junos OS Evolved. When Juniper Flow Monitoring (jflow) is configured, route churn that updates BGP next hops triggers a memory leak in rpd. The daemon fails to release memory allocated for socket-related structures after their effective lifetime ends. Memory consumption grows incrementally with each next-hop update, and the leak eventually exhausts available memory, forcing rpd to crash and restart. The crash disrupts BGP sessions and routing table convergence across the device.
Operators can confirm the leak by inspecting per-thread memory utilization with the command show task memory detail | match so_in, which reports growing allocations for so_in and so_in6 socket structures.
Root Cause
The root cause is a Missing Release of Memory after Effective Lifetime condition [CWE-401] in rpd. Code paths handling BGP next-hop updates within the jflow scenario allocate socket-related buffers (so_in, so_in6) but do not free them once they are no longer needed. Repeated BGP next-hop churn amplifies the leak until the daemon exhausts its memory and terminates.
Attack Vector
The vulnerability is exploitable over the network without authentication or user interaction. An attacker capable of influencing BGP advertisements reaching an affected device, for example via a peering session or by propagating updates through upstream peers, can induce sustained next-hop churn. Devices configured with jflow are required for the leak to manifest. Sustained exploitation results in rpd crashing and restarting, impairing routing availability.
No verified public proof-of-concept code is available. See the Juniper Security Advisory JSA75752 for technical details.
Detection Methods for CVE-2024-21611
Indicators of Compromise
- Steadily increasing memory allocations reported by show task memory detail | match so_in, particularly growth in so_in and so_in6 counters
- Unexpected rpd process restarts and associated syslog messages indicating daemon termination
- BGP session flaps and routing reconvergence events correlated with rpd crashes
Detection Strategies
- Periodically run show task memory detail and baseline rpd memory usage to identify abnormal growth trends
- Monitor BGP next-hop update rates and flag sustained churn on jflow-enabled devices
- Alert on rpd process restarts and core file generation through Junos syslog forwarding
Monitoring Recommendations
- Forward Junos syslog and SNMP traps to a centralized SIEM and create rules for rpd crash or restart events
- Track per-thread memory utilization metrics over time to identify slow leaks before service impact
- Correlate BGP route churn telemetry with device memory metrics to detect exploitation attempts
How to Mitigate CVE-2024-21611
Immediate Actions Required
- Upgrade affected Junos OS devices to 21.4R3, 22.1R3, 22.2R3, or later fixed releases
- Upgrade Junos OS Evolved devices to 21.4R3-EVO, 22.1R3-EVO, 22.2R3-EVO, or later fixed releases
- Identify all devices running jflow with BGP and prioritize them for patching
- Restart rpd on affected devices as a temporary measure when memory exhaustion is imminent
Patch Information
Juniper Networks has released fixed software addressing CVE-2024-21611. Refer to the Juniper Security Advisory JSA75752 for the complete list of fixed releases and upgrade guidance. Junos OS releases earlier than 21.4R1 are not affected.
Workarounds
- Apply BGP import policies to reduce route churn and limit unnecessary next-hop updates
- Disable Juniper Flow Monitoring (jflow) on affected devices if operationally feasible until patching is complete
- Implement BGP maximum-prefix limits and route dampening to constrain churn from external peers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
