CVE-2024-30382: Juniper Junos RPD DoS Vulnerability

CVE-2024-30382 Overview

CVE-2024-30382 is an Improper Handling of Exceptional Conditions vulnerability [CWE-755] in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. A network-based, unauthenticated attacker can send a specific routing update that triggers memory corruption and crashes rpd, causing a Denial of Service (DoS). The condition is only exploitable when the system is configured for Class of Service-based forwarding (CBF) with a policy map containing a cos-next-hop-map action. Juniper published the vulnerability under advisory JSA79174 with a CVSS v4.0 score of 8.7.

Critical Impact
An unauthenticated remote attacker can crash the routing protocol daemon on affected Juniper devices, disrupting routing operations and producing a sustained denial of service against core network infrastructure.

Affected Products

Junos OS: all versions before 20.4R3-S10, 21.2 before 21.2R3-S8, 21.3 before 21.3R3, 21.4 before 21.4R3, and 22.1 before 22.1R2
Junos OS Evolved: all versions before 21.2R3-S8-EVO, 21.3 before 21.3R3-EVO, 21.4 before 21.4R3-EVO, and 22.1 before 22.1R2-EVO
Devices configured with Class of Service-based forwarding (CBF) using a cos-next-hop-map policy action

Discovery Timeline

2024-04-12 - CVE-2024-30382 published to NVD
2025-02-06 - Last updated in NVD database

Technical Details for CVE-2024-30382

Vulnerability Analysis

The vulnerability resides in the routing protocol daemon (rpd), the user-space process responsible for handling routing updates and forwarding decisions on Junos OS and Junos OS Evolved. The daemon fails to properly handle an exceptional condition when processing a specifically crafted routing update on systems configured for Class of Service-based forwarding. The improper handling results in memory corruption, which causes the rpd process to core. When rpd terminates, routing adjacencies drop and traffic forwarding is disrupted until the daemon restarts. Repeated triggering produces a sustained denial of service against the affected device.

Root Cause

The root cause is improper handling of exceptional conditions [CWE-755] inside the CBF code path that processes cos-next-hop-map policy actions. When rpd receives a routing update that interacts with this configuration, error handling diverges from expected behavior and corrupts process memory.

Attack Vector

Exploitation requires only network reachability to the routing protocol the target device speaks. The attacker does not need credentials or user interaction. The attacker injects a specific routing update through an established or accepted routing protocol session, and the malformed condition triggers the rpd core. Only devices configured with CBF and a cos-next-hop-map action are vulnerable, narrowing the exploitable population.

No public proof-of-concept or in-the-wild exploitation has been reported. Refer to the Juniper Security Advisory JSA79174 for vendor technical details.

Detection Methods for CVE-2024-30382

Indicators of Compromise

Unexpected rpd core files generated on Junos OS or Junos OS Evolved devices, visible via show system core-dumps
Routing protocol adjacency flaps (BGP, OSPF, IS-IS) correlated with rpd restart events in messages and chassisd logs
Repeated rpd process restarts observed through show system processes extensive or syslog entries referencing rpd[<pid>]: terminated

Detection Strategies

Audit running configurations for CBF policies containing cos-next-hop-map actions to identify exposed devices using show configuration class-of-service
Correlate routing update anomalies on peering sessions with subsequent rpd crash events to detect exploitation attempts
Forward Junos syslog and core-dump events to a centralized SIEM and alert on rpd daemon failures across the fleet

Monitoring Recommendations

Enable streaming telemetry or SNMP traps for routing daemon state changes and process restarts on all Junos devices
Monitor BGP and IGP session stability metrics for unexplained drops affecting devices that match the vulnerable configuration profile
Track inbound routing updates from external peers and validate that route policies enforce strict prefix and attribute filtering

How to Mitigate CVE-2024-30382

Immediate Actions Required

Inventory all Junos OS and Junos OS Evolved devices and identify those running affected versions with CBF and cos-next-hop-map configured
Schedule and apply the fixed Junos OS or Junos OS Evolved release on every exposed device according to the maintenance window policy
Restrict routing protocol peering to trusted neighbors and enforce authentication on all BGP, OSPF, and IS-IS sessions

Patch Information

Juniper has released fixed software in Junos OS 20.4R3-S10, 21.2R3-S8, 21.3R3, 21.4R3, 22.1R2, and later, and in Junos OS Evolved 21.2R3-S8-EVO, 21.3R3-EVO, 21.4R3-EVO, 22.1R2-EVO, and later. Upgrade details and download links are documented in Juniper Security Advisory JSA79174.

Workarounds

Remove the cos-next-hop-map action from CBF policy maps if Class of Service-based forwarding is not strictly required
Apply strict inbound routing policies to drop malformed or unexpected routing updates from external peers
Restrict the management and control plane with firewall filters that permit routing protocols only from authorized neighbors

bash

# Verify whether the device uses a vulnerable CBF cos-next-hop-map configuration
show configuration class-of-service forwarding-policy | match cos-next-hop-map

# Inspect rpd process health and core dumps
show system processes extensive | match rpd
show system core-dumps | match rpd

# Upgrade to a fixed release (example for Junos OS 22.1)
request system software add /var/tmp/junos-install-22.1R2.tgz no-validate reboot