CVE-2024-21612: Juniper Junos OS Evolved DoS Vulnerability

CVE-2024-21612 Overview

CVE-2024-21612 is a Denial of Service (DoS) vulnerability in the Object Flooding Protocol (OFP) service of Juniper Networks Junos OS Evolved. An unauthenticated, network-based attacker can send specific TCP packets to an open OFP port, causing the OFP process to crash and triggering a restart of the Routing Engine (RE). Continuous transmission of these crafted packets results in a sustained DoS condition on affected devices. The flaw is classified under [CWE-228] (Improper Handling of Syntactically Invalid Structure) and affects multiple release trains of Junos OS Evolved. Juniper published advisory JSA75753 documenting the issue and fixed releases.

Critical Impact
Remote attackers can sustain a Denial of Service against Junos OS Evolved routing platforms by sending crafted TCP packets to the OFP service, repeatedly crashing the Routing Engine.

Affected Products

Juniper Junos OS Evolved – all versions earlier than 21.2R3-S7-EVO
Juniper Junos OS Evolved 21.3 versions earlier than 21.3R3-S5-EVO, 21.4 versions earlier than 21.4R3-S5-EVO, and 22.1 versions earlier than 22.1R3-S4-EVO
Juniper Junos OS Evolved 22.2 versions earlier than 22.2R3-S3-EVO, 22.3 versions earlier than 22.3R3-EVO, and 22.4 versions earlier than 22.4R2-EVO/22.4R3-EVO

Discovery Timeline

2024-01-12 - CVE-2024-21612 published to NVD
2024-01-12 - Juniper publishes security advisory JSA75753
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21612

Vulnerability Analysis

The vulnerability resides in the Object Flooding Protocol (OFP) service, an internal distribution mechanism used by Junos OS Evolved to synchronize state across the platform. The OFP service listens on a TCP port that is reachable on platform interfaces. When the service receives TCP packets with a syntactically invalid structure, it fails to handle the malformed input safely and crashes.

A crash of the OFP process forces a restart of the Routing Engine (RE). During the restart window, routing functions become unavailable, disrupting traffic forwarding decisions and control-plane operations. An attacker who continues to send the trigger packets prevents the RE from stabilizing, producing a sustained outage.

Because exploitation requires no authentication, no user interaction, and only network reachability to the OFP port, the attack surface is exposed wherever the OFP port is accessible. The flaw impacts availability only — confidentiality and integrity of data are not affected.

Root Cause

The root cause is improper handling of syntactically invalid structures in the OFP service input parser [CWE-228]. The service does not validate the structural integrity of incoming TCP packets before processing them, leading to a fatal error and process termination.

Attack Vector

The vector is purely network-based. An attacker sends specific TCP packets to an open OFP port on a vulnerable Junos OS Evolved device. No credentials, prior access, or victim interaction are required. Repeated delivery of the trigger packets maintains the DoS condition.

No verified proof-of-concept code is publicly available. Refer to Juniper Security Advisory JSA75753 for vendor-confirmed technical details.

Detection Methods for CVE-2024-21612

Indicators of Compromise

Unexpected restarts of the Routing Engine accompanied by OFP process crash entries in system logs.
Repeated TCP connection attempts from untrusted sources to the OFP service port on routing platforms.
Loss of control-plane availability or routing adjacency flaps coinciding with inbound traffic bursts to internal Junos OS Evolved service ports.

Detection Strategies

Monitor show system core-dumps and chassis daemon logs on Junos OS Evolved devices for OFP-related crash signatures and RE restarts.
Inspect network telemetry (NetFlow, IPFIX, packet captures) for unsolicited TCP traffic targeting OFP service ports from outside the management or fabric network.
Correlate RE restart events with upstream firewall or ACL logs to identify the source of the trigger traffic.

Monitoring Recommendations

Alert on consecutive Routing Engine restarts within a short interval, as this pattern indicates a sustained DoS attempt.
Track SNMP traps and syslog events for chassisd and OFP-related daemons across the fleet.
Centralize Junos OS Evolved logs into a SIEM and build dashboards for control-plane stability across critical routers.

How to Mitigate CVE-2024-21612

Immediate Actions Required

Upgrade affected Junos OS Evolved devices to a fixed release listed in JSA75753: 21.2R3-S7-EVO, 21.3R3-S5-EVO, 21.4R3-S5-EVO, 22.1R3-S4-EVO, 22.2R3-S3-EVO, 22.3R3-EVO, 22.4R2-EVO/22.4R3-EVO, or later.
Audit which interfaces expose the OFP service port and restrict reachability to trusted management and fabric networks only.
Enable logging and alerting for Routing Engine restarts and OFP process crashes across the routing fleet.

Patch Information

Juniper Networks released fixed software versions documented in advisory JSA75753. Apply the appropriate fixed release for each affected branch as listed above. Confirm the running version with show version after upgrade.

Workarounds

Apply firewall filters or loopback filters on the Routing Engine to block untrusted TCP traffic destined to the OFP service port.
Restrict access to control-plane and internal service ports using infrastructure ACLs at network ingress points.
Segment management and fabric networks from production data paths to limit reachability to internal Junos OS Evolved services.

bash

# Example: restrict access to control-plane services with a Junos firewall filter
set firewall family inet filter protect-re term allow-trusted from source-address <trusted-mgmt-prefix>
set firewall family inet filter protect-re term allow-trusted then accept
set firewall family inet filter protect-re term block-ofp from protocol tcp
set firewall family inet filter protect-re term block-ofp then discard
set interfaces lo0 unit 0 family inet filter input protect-re