CVE-2024-39529: Juniper Junos PFE DoS Vulnerability

CVE-2024-39529 Overview

CVE-2024-39529 is a Use of Externally-Controlled Format String vulnerability [CWE-134] in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series devices. An unauthenticated, network-based attacker can trigger a PFE crash and restart, producing a sustained Denial-of-Service (DoS) condition.

Exploitation requires that DNS Domain Generation Algorithm (DGA) detection or tunnel detection is enabled together with DNS-filtering traceoptions. When specific valid transit DNS traffic reaches a vulnerable device, the PFE crashes.

Critical Impact
Unauthenticated attackers can repeatedly crash the Packet Forwarding Engine on Juniper SRX Series firewalls, disrupting transit traffic and network availability.

Affected Products

Juniper Junos OS — all versions before 21.4R3-S6
Juniper Junos OS 22.2 before 22.2R3-S3, 22.3 before 22.3R3-S3, 22.4 before 22.4R3, 23.2 before 23.2R2
Juniper SRX Series firewalls (SRX100, SRX110, SRX2x0, SRX300/320/340/345/380, SRX5x0, SRX1400/1500/1600, SRX2300, SRX3400/3600, SRX4000/4100/4200/4300/4600/4700, SRX5000/5400/5600/5800, SRX650)

Discovery Timeline

2024-07-11 - CVE-2024-39529 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-39529

Vulnerability Analysis

The defect lives in the DNS filtering subsystem of the Packet Forwarding Engine on SRX Series devices. When DNS DGA detection or DNS tunnel detection is enabled and DNS-filtering traceoptions are configured, the PFE processes incoming transit DNS packets through a code path that passes externally-derived data into a format string function without proper sanitization.

The result is a format string flaw that corrupts process state and forces the PFE to crash. Junos automatically restarts the PFE, but each malicious packet repeats the cycle, producing a sustained outage on transit traffic for the affected device.

Root Cause

The root cause is improper handling of attacker-influenced content inside DNS packets that are logged or formatted by the PFE's DNS-filtering trace functionality. Format specifiers embedded in the parsed DNS data are interpreted by the formatting routine instead of being treated as literal strings. This matches the CWE-134 pattern, where untrusted input flows into a printf-style sink.

Attack Vector

The attack is remote and unauthenticated. An attacker sends crafted but otherwise valid transit DNS traffic across an SRX device that has the vulnerable DNS-filtering configuration enabled. No user interaction or privileges are required. Because trace and filtering features are commonly enabled on SRX devices deployed at network edges, exposure can include internet-facing perimeters.

No verified public proof-of-concept code exists for CVE-2024-39529. The vulnerability manifests through transit DNS traffic processed by the PFE while DNS DGA detection or tunnel detection and DNS-filtering traceoptions are configured. See the Juniper Security Advisory JSA82988 for vendor technical details.

Detection Methods for CVE-2024-39529

Indicators of Compromise

Repeated PFE crash and restart events logged in Junos chassisd and PFE logs on SRX devices.
Sudden loss of transit traffic forwarding correlated with DNS-filtering trace activity.
Core files generated by the PFE process following the receipt of transit DNS traffic.

Detection Strategies

Inspect Junos logs for PFE restart messages and correlate timestamps with inbound DNS packet bursts.
Audit device configurations for the simultaneous presence of DNS DGA detection or DNS tunnel detection and DNS-filtering traceoptions.
Monitor SNMP and streaming telemetry for PFE availability state changes on SRX platforms.

Monitoring Recommendations

Forward Junos syslog and PFE core file alerts to a centralized SIEM for correlation.
Track DNS traffic volume and anomalies traversing SRX devices, particularly on segments where DNS filtering is enforced.
Alert on multiple PFE restarts within short time windows as a high-priority operational event.

How to Mitigate CVE-2024-39529

Immediate Actions Required

Upgrade affected Junos OS instances to a fixed release: 21.4R3-S6, 22.2R3-S3, 22.3R3-S3, 22.4R3, 23.2R2, or later.
If immediate patching is not possible, review whether DNS DGA detection, DNS tunnel detection, and DNS-filtering traceoptions are all required in production.
Inventory all SRX Series devices and confirm Junos version and DNS filtering configuration state.

Patch Information

Juniper Networks has released fixed Junos OS versions addressing CVE-2024-39529. Refer to Juniper Security Advisory JSA82988 for the complete list of fixed releases and upgrade guidance for each affected SRX platform.

Workarounds

Disable DNS-filtering traceoptions on affected SRX devices until the fixed Junos release is applied.
Alternatively, disable DNS DGA detection and DNS tunnel detection features if they are not operationally required.
Restrict and inspect transit DNS traffic with upstream controls where feasible to reduce exposure of vulnerable devices.

bash

# Configuration example: remove DNS-filtering traceoptions on Junos SRX
configure
delete security utm feature-profile content-filtering dns-filtering traceoptions
commit and-quit