CVE-2024-39555: Juniper Junos BGP DoS Vulnerability

CVE-2024-39555 Overview

CVE-2024-39555 is a Denial of Service (DoS) vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved. The flaw stems from improper handling of exceptional conditions [CWE-755] when parsing a malformed BGP update message containing a specifically crafted tunnel encapsulation attribute. Processing the malformed attribute when segment routing is enabled causes improper parsing of remaining attributes and triggers a BGP session reset. Continued receipt of the malformed messages produces a sustained DoS condition. The issue affects both eBGP and iBGP, in IPv4 and IPv6 deployments, and requires the attacker to have at least one established BGP session.

Critical Impact
A remote attacker with an established BGP session can repeatedly reset Junos RPD BGP sessions on routers with segment routing enabled, disrupting routing availability.

Affected Products

Juniper Junos OS: all versions before 21.4R3-S8; 22.2 before 22.2R3-S4; 22.3 before 22.3R3-S3; 22.4 before 22.4R3-S3; 23.2 before 23.2R2-S1; 23.4 before 23.4R1-S2 and 23.4R2
Juniper Junos OS Evolved: all versions before 21.4R3-S8-EVO; 22.2-EVO before 22.2R3-S4-EVO; 22.3-EVO before 22.3R3-S3-EVO; 22.4-EVO before 22.4R3-S3-EVO; 23.2-EVO before 23.2R2-S1-EVO; 23.4-EVO before 23.4R1-S2-EVO and 23.4R2-EVO
Systems with segment routing enabled in the BGP configuration

Discovery Timeline

2024-07-10 - CVE-2024-39555 published to NVD
2025-02-07 - Last updated in NVD database

Technical Details for CVE-2024-39555

Vulnerability Analysis

The vulnerability resides in how Junos RPD parses BGP UPDATE messages that include a tunnel encapsulation path attribute. When a session has segment routing enabled, the daemon attempts to process the tunnel encapsulation sub-TLVs. A specifically malformed encoding causes the parser to mishandle the attribute boundary, leading to improper parsing of remaining path attributes within the same UPDATE message. RPD reacts to the malformed input by emitting a BGP NOTIFICATION with code 3 (Update Message Error) and subcode 1 (invalid attribute list), which tears down the BGP session. Re-establishment is automatic, but each new UPDATE containing the malformed attribute produces another reset, yielding a sustained routing outage.

Root Cause

The root cause is improper handling of an exceptional condition during BGP path attribute parsing in the segment routing code path. The parser fails to safely contain the error to the offending attribute and instead invalidates the entire attribute list, mapping to [CWE-755] Improper Handling of Exceptional Conditions.

Attack Vector

Exploitation requires a network-adjacent attacker who already controls a BGP peer with an established session to a vulnerable Junos device, or who can inject crafted UPDATE messages into an existing peering. The attacker sends a BGP UPDATE containing the malformed tunnel encapsulation attribute. No authentication beyond the legitimate BGP peering relationship is needed, and no user interaction is involved. See the Juniper Security Advisory JSA83015 for protocol-level technical details.

Detection Methods for CVE-2024-39555

Indicators of Compromise

BGP NOTIFICATION messages with code 3 (Update Message Error) and subcode 1 (invalid attribute list) observed in rpd logs or peer logs.
Repeated BGP session resets correlated with received UPDATE messages from a specific peer.
RPD log entries referencing tunnel encapsulation attribute parsing errors on devices with segment routing enabled.

Detection Strategies

Monitor BGP session state transitions and alert on flap rates exceeding normal operational baselines.
Inspect show log messages and show bgp neighbor output for repeated NOTIFICATION sent: 3/1 events.
Capture BGP UPDATE traffic with packet capture tools and decode tunnel encapsulation attributes (type 23) for malformed sub-TLV lengths.

Monitoring Recommendations

Forward Junos syslog and rpd traces to a centralized logging or SIEM platform for correlation across peering edges.
Track BGP session uptime metrics via SNMP or streaming telemetry and alert on rapid resets per peer.
Review segment routing configuration inventory to identify the subset of devices exposed to this attack path.

How to Mitigate CVE-2024-39555

Immediate Actions Required

Upgrade affected Junos OS and Junos OS Evolved devices to the fixed releases listed in Juniper Security Advisory JSA83015.
Audit BGP peers and restrict sessions to trusted ASNs and prefixes; remove unused peerings, especially on devices with segment routing enabled.
Confirm whether segment routing is required on each device; the vulnerability only affects systems where it is enabled.

Patch Information

Juniper has released fixed software in Junos OS 21.4R3-S8, 22.2R3-S4, 22.3R3-S3, 22.4R3-S3, 23.2R2-S1, 23.4R1-S2, 23.4R2, and all subsequent releases, with corresponding -EVO builds for Junos OS Evolved. Refer to Juniper Security Advisory JSA83015 for the authoritative version matrix and download links.

Workarounds

Disable segment routing on BGP-enabled devices where it is not operationally required, which removes exposure to this specific parsing path.
Apply BGP peer authentication (TCP-AO or MD5) and infrastructure ACLs to limit who can establish or inject into BGP sessions.
Use BGP import policies and prefix limits to constrain attacker influence, recognizing these do not block the malformed attribute itself.

bash

# Verify whether segment routing is configured on a Junos device
show configuration protocols isis | display set | match segment-routing
show configuration protocols mpls | display set | match source-packet-routing

# Inspect BGP NOTIFICATION history for the invalid attribute list signature
show log messages | match "NOTIFICATION"
show bgp neighbor | match "Last error"