CVE-2024-21614 Overview
CVE-2024-21614 is an Improper Check for Unusual or Exceptional Conditions vulnerability [CWE-754] in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. A network-based, unauthenticated attacker can crash rpd by issuing a specific query through Dynamic Rendering (DREND) when NETCONF and gRPC are enabled. Repeated execution of the query causes a sustained Denial of Service (DoS) on affected routing platforms.
Critical Impact
Continuous exploitation forces rpd into a crash-restart loop, disrupting routing protocol operations across affected Juniper Junos OS and Junos OS Evolved devices.
Affected Products
- Juniper Networks Junos OS 22.2 versions earlier than 22.2R2-S2, 22.2R3
- Juniper Networks Junos OS 22.3 versions earlier than 22.3R2, 22.3R3
- Juniper Networks Junos OS Evolved 22.2 versions earlier than 22.2R2-S2-EVO, 22.2R3-EVO, and 22.3 versions earlier than 22.3R2-EVO, 22.3R3-EVO
Discovery Timeline
- 2024-01-12 - CVE-2024-21614 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2024-21614
Vulnerability Analysis
The Routing Protocol Daemon (rpd) is the core process responsible for routing protocol operations on Junos OS and Junos OS Evolved. The daemon fails to properly check for unusual or exceptional conditions when processing a specific query routed through Dynamic Rendering (DREND). When NETCONF and gRPC management interfaces are enabled, an unauthenticated remote attacker can submit the triggering query and force rpd to crash and restart.
The issue is classified under CWE-754 — Improper Check for Unusual or Exceptional Conditions. Because rpd governs routing decisions, sustained crashes interrupt protocol adjacencies and traffic forwarding logic, producing a network-impacting DoS condition.
Root Cause
The defect lies in the Dynamic Rendering (DREND) code path within rpd. The daemon does not handle an exceptional condition raised by a specific malformed or unexpected query, leading to an unhandled fault and process termination. The condition only manifests on builds where DREND processing of the offending query is reachable through NETCONF or gRPC.
Attack Vector
Exploitation requires network reachability to the NETCONF or gRPC management services on the affected Junos device. No authentication, user interaction, or privileges are required. An attacker repeatedly sends the specific DREND query, and each request triggers an rpd crash and restart. Continuous submission of the query produces a sustained DoS condition against routing operations.
No public proof-of-concept or in-the-wild exploitation has been reported. Full technical details and triggering conditions are described in Juniper Security Advisory JSA75755.
Detection Methods for CVE-2024-21614
Indicators of Compromise
- Repeated rpd process crashes and automatic restarts logged in /var/log/messages or equivalent Junos OS Evolved logs
- Unexpected NETCONF or gRPC queries originating from untrusted networks targeting management interfaces
- Routing protocol adjacency flaps (BGP, OSPF, IS-IS) correlated with rpd restart events
Detection Strategies
- Monitor Junos syslog for RPD_TASK_BEGIN, RPD_KRT_VERSION, and core dump messages indicating rpd termination
- Inspect NETCONF and gRPC session logs for anomalous query patterns or high-frequency requests from a single source
- Correlate routing protocol adjacency state changes with management-plane traffic spikes
Monitoring Recommendations
- Forward Junos OS and Junos OS Evolved syslog data to a centralized SIEM and alert on repeated rpd core events
- Track NETCONF (TCP/830) and gRPC session counts and source IP diversity on edge and core devices
- Baseline normal management-plane traffic so that DREND query bursts deviate visibly from expected patterns
How to Mitigate CVE-2024-21614
Immediate Actions Required
- Upgrade affected Junos OS and Junos OS Evolved devices to fixed releases listed in Juniper Security Advisory JSA75755
- Restrict NETCONF and gRPC access to trusted management networks using firewall filters and loopback ACLs
- Audit which devices have NETCONF and gRPC enabled and disable the services where they are not required
Patch Information
Juniper has released fixed software in Junos OS 22.2R2-S2, 22.2R3, 22.3R2, 22.3R3, and later releases. For Junos OS Evolved, fixes are available in 22.2R2-S2-EVO, 22.2R3-EVO, 22.3R2-EVO, 22.3R3-EVO, and later. Refer to Juniper Security Advisory JSA75755 for the complete list of fixed versions and upgrade guidance.
Workarounds
- Disable NETCONF and gRPC on devices where remote programmatic management is not required
- Apply Junos firewall filters on the loopback interface to permit NETCONF and gRPC only from authorized management hosts
- Place management interfaces in a dedicated out-of-band management VRF to limit exposure to untrusted networks
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
