CVE-2024-39549: Juniper Junos BGP DoS Vulnerability

CVE-2024-39549 Overview

CVE-2024-39549 is a memory leak vulnerability ([CWE-401]) in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated, network-based attacker can send a malformed Border Gateway Protocol (BGP) Path attribute update that causes rpd to allocate memory for logging the bad path attribute. The daemon fails to release this memory in all circumstances, allowing repeated exploitation to exhaust available memory and trigger a Denial of Service (DoS) condition on affected routers.

Critical Impact
A remote attacker can progressively exhaust rpd memory on Juniper routers by sending malformed BGP path attribute updates, ultimately disrupting routing operations and forcing a manual rpd restart.

Affected Products

Juniper Networks Junos OS (all versions before 21.2R3-S8, and 21.4, 22.2, 22.3, 22.4, 23.2, 23.4 prior to the listed fixed releases)
Juniper Networks Junos OS Evolved (all versions before 21.2R3-S8-EVO, and 21.4, 22.2, 22.3, 22.4, 23.2, 23.4 prior to the listed fixed EVO releases)
Routing Protocol Daemon (rpd) processing BGP path attribute updates

Discovery Timeline

2024-07-11 - CVE-2024-39549 published to the National Vulnerability Database
2024-07-11 - Juniper Networks publishes security advisory JSA83011
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-39549

Vulnerability Analysis

The vulnerability resides in the rpd process, the core daemon responsible for handling routing protocols on Junos OS and Junos OS Evolved. When rpd receives a BGP UPDATE message containing a malformed Path attribute, it allocates memory to log the invalid attribute for diagnostic purposes. Under specific conditions, this allocated memory is not released back to the heap after the logging operation completes, producing a slow memory leak that grows with every malformed message received.

Because BGP sessions are long-lived and update messages can be sent repeatedly, an attacker capable of injecting traffic into a BGP peering session can amplify the leak until rpd exhausts the system's available memory. The result is degraded routing performance and eventual daemon failure, which interrupts route processing across the device.

Root Cause

The root cause is a Missing Release of Memory after Effective Lifetime ([CWE-401]). The logging code path within rpd allocates a buffer to record the malformed Path attribute but does not consistently free that buffer along all return paths after the attribute is validated and rejected. Repeated invocation of this error-handling path leaks memory cumulatively.

Attack Vector

Exploitation requires the ability to send BGP UPDATE messages to the affected router. In practice this means an attacker must either be a configured BGP peer, be positioned to inject traffic into an established BGP session, or operate from a network where malformed updates can propagate from an upstream peer. No authentication on the management plane is required; the attack uses the routing protocol itself.

The vulnerability does not impact confidentiality or integrity. The exploitation outcome is sustained resource exhaustion in rpd, leading to a DoS. Operators can confirm leak progression using show system memory or show system monitor memory status, and reclaim memory only by restarting rpd.

Detection Methods for CVE-2024-39549

Indicators of Compromise

Steadily increasing rpd memory utilization without a corresponding growth in routing table size or session count.
Junos log entries referencing malformed BGP Path attribute parsing errors generated by rpd.
BGP session flaps or rpd instability on routers peering with untrusted or recently changed neighbors.

Detection Strategies

Baseline rpd memory consumption across the fleet and alert on sustained upward drift that does not match topology changes.
Monitor BGP UPDATE error counters and syslog messages indicating rejected Path attributes.
Correlate rpd memory growth with the BGP peer that introduced the malformed updates to identify the source.

Monitoring Recommendations

Poll show system memory and show system monitor memory status via NETCONF or SNMP at regular intervals.
Forward Junos syslog to a centralized logging platform and create rules for BGP path attribute parse errors.
Track rpd daemon restarts and unscheduled memory reclamations as operational health signals.

How to Mitigate CVE-2024-39549

Immediate Actions Required

Upgrade Junos OS and Junos OS Evolved to a fixed release listed in Juniper advisory JSA83011 as soon as maintenance windows permit.
Restart rpd on routers showing abnormal memory consumption to reclaim leaked memory until patching is complete.
Audit BGP peer configurations and remove or restrict sessions with untrusted neighbors.

Patch Information

Juniper Networks has released fixed software in Junos OS versions 21.2R3-S8, 21.4R3-S8, 22.2R3-S4, 22.3R3-S3, 22.4R3-S3, 23.2R2-S1, 23.4R1-S2, 23.4R2, and later, with matching -EVO builds for Junos OS Evolved. Full version details and download links are available in the Juniper Security Advisory JSA83011.

Workarounds

Apply BGP import policies and inbound filtering on peering sessions to drop or sanitize unexpected Path attributes where supported.
Restrict BGP peering to authenticated, trusted neighbors and enforce TCP-AO or MD5 authentication on sessions.
Schedule periodic rpd restarts on exposed routers as a stop-gap to reclaim leaked memory before patches are deployed.

bash

# Operational commands to monitor rpd memory and recover from the leak
user@host> show system memory
user@host> show system monitor memory status
user@host> restart routing