CVE-2024-30395: Juniper Junos RPD DoS Vulnerability

CVE-2024-30395 Overview

CVE-2024-30395 is an Improper Validation of Specified Type of Input vulnerability [CWE-1287] in the Routing Protocol Daemon (rpd) of Juniper Junos OS and Junos OS Evolved. An unauthenticated, network-based attacker can trigger a Denial of Service (DoS) condition by sending a Border Gateway Protocol (BGP) update containing a malformed tunnel encapsulation attribute Type-Length-Value (TLV) over an established BGP session. Processing the malformed attribute causes rpd to crash and restart, disrupting routing operations. The flaw is tracked in Juniper Security Advisory JSA79095 and is related but distinct from the earlier issue documented in JSA75739.

Critical Impact

A single malformed BGP update from an established peer can crash the Routing Protocol Daemon repeatedly, producing sustained routing outages across affected Junos OS and Junos OS Evolved devices.

Affected Products

• Juniper Junos OS — all versions before 21.2R3-S7, and 21.3, 21.4, 22.1, 22.2, 22.3, 22.4, and 23.2 branches prior to their respective fixed releases
• Juniper Junos OS Evolved — all versions before 21.2R3-S7-EVO, and 21.3-EVO, 21.4-EVO, 22.2-EVO, 22.3-EVO, 22.4-EVO, and 23.2-EVO branches prior to their respective fixed releases
• Devices running BGP with tunnel encapsulation attribute processing enabled

Discovery Timeline

• 2024-04-12 - CVE-2024-30395 published to NVD by Juniper Networks
• 2025-02-06 - Last updated in NVD database

Technical Details for CVE-2024-30395

Vulnerability Analysis

The vulnerability resides in how rpd parses the BGP Tunnel Encapsulation attribute defined in RFC 9012. This attribute carries nested TLVs describing tunnel endpoints and parameters. When rpd receives a BGP UPDATE message containing a tunnel encapsulation attribute with a specifically malformed inner TLV, the daemon fails to validate the structure correctly and aborts. The daemon then restarts, tearing down BGP adjacencies and clearing learned routes. Because rpd is central to all routing functions on Junos OS and Junos OS Evolved platforms, an attacker who can deliver crafted updates over an established BGP session can interrupt forwarding and produce sustained route flapping.

Root Cause

The root cause is improper validation of a specified input type during BGP attribute parsing. The rpd process accepts the tunnel encapsulation attribute without enforcing strict bounds and type checks on the embedded TLV, allowing structural inconsistencies to reach internal handlers that assume well-formed input. Improper input type validation aligns with CWE-1287.

Attack Vector

Exploitation requires an established BGP session between the attacker-controlled or attacker-influenced peer and the target Junos device. No authentication beyond the existing BGP peering is needed, and no user interaction is involved. The attacker injects a single crafted UPDATE message containing the malformed tunnel encapsulation TLV. Repeated delivery sustains the DoS by continually crashing rpd as it restarts and re-establishes sessions. The flaw can be triggered remotely across the BGP control plane, including through transit autonomous systems that propagate the malformed attribute.

No verified public proof-of-concept code is available. See the Juniper Security Advisory JSA79095 for technical details.

Detection Methods for CVE-2024-30395

Indicators of Compromise

• Unexpected rpd process crashes and core files on Junos OS or Junos OS Evolved devices
• BGP sessions flapping or repeatedly resetting without a corresponding network change
• System log entries showing rpd restart events coinciding with received BGP UPDATE messages
• Routing table churn and FIB recomputation following peer sessions transitioning to Idle or Active

Detection Strategies

• Monitor rpd daemon health and crash counters using show system processes extensive and review /var/crash/ for new core files
• Inspect syslog and chassis logs for RPD_TASK_BEGIN, RPD_ABORT, and process restart messages correlated with BGP peer activity
• Enable BGP traceoptions on suspect peers to capture UPDATE message contents and identify malformed tunnel encapsulation attributes

Monitoring Recommendations

• Forward Junos syslog and BGP event telemetry to a central SIEM or data lake for cross-device correlation of rpd crashes
• Alert on simultaneous BGP session resets across multiple peers, which can indicate propagation of a malformed attribute
• Track BGP UPDATE message rates and attribute distributions on edge routers to baseline normal tunnel encapsulation traffic

How to Mitigate CVE-2024-30395

Immediate Actions Required

• Upgrade affected devices to a fixed release listed in Juniper Security Advisory JSA79095, including 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R3, 23.2R1-S2, 23.2R2, or the corresponding -EVO builds
• Inventory all Junos OS and Junos OS Evolved devices participating in BGP and verify their running versions against the advisory
• Restrict BGP peering to known, trusted neighbors and validate inbound route policies on external sessions

Patch Information

Juniper Networks has released fixed software in JSA79095. Junos OS fixes are available in 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R3, 23.2R1-S2, 23.2R2, and subsequent releases. Junos OS Evolved fixes are available in 21.2R3-S7-EVO, 21.3R3-S5-EVO, 21.4R3-S5-EVO, 22.2R3-S3-EVO, 22.3R3-S2-EVO, 22.4R3-EVO, 23.2R1-S2-EVO, 23.2R2-EVO, and subsequent releases.

Workarounds

• Apply BGP import policies that reject or strip the tunnel encapsulation attribute from untrusted peers until patching is complete
• Limit BGP peering to authenticated sessions using TCP-AO or MD5 and enforce maximum prefix and attribute filtering
• Configure rpd restart monitoring and high-availability features such as graceful restart to reduce blast radius during forced restarts

# Configuration example - reject tunnel encapsulation attribute from untrusted peers
set policy-options policy-statement REJECT-TUNNEL-ENCAP term 1 from attribute tunnel-encapsulation
set policy-options policy-statement REJECT-TUNNEL-ENCAP term 1 then reject
set protocols bgp group EXTERNAL import REJECT-TUNNEL-ENCAP
commit