CVE-2024-39559: Juniper Junos OS Evolved DoS Vulnerability

CVE-2024-39559 Overview

CVE-2024-39559 is a high-severity denial-of-service vulnerability in Juniper Networks Junos OS Evolved. The flaw stems from an Improper Check for Unusual or Exceptional Conditions [CWE-754] in packet processing. A network-based unauthenticated attacker can crash the device and generate a vmcore by sending a specific TCP packet over an established TCP session with MD5 authentication enabled. The packet must target an accessible port on the device and arrive within a narrow timing window, making exploitation a race condition. Continued receipt of the triggering packet produces a sustained DoS condition. Only dual Routing Engine (RE) systems with Nonstop Active Routing (NSR) enabled are affected, and only TCP sessions protected by MD5 authentication such as BGP with MD5 are exposed.

Critical Impact
Unauthenticated attackers can crash affected Junos OS Evolved routers, disrupting BGP and other MD5-authenticated TCP services and causing sustained network outages.

Affected Products

Juniper Junos OS Evolved: all versions before 21.2R3-S8-EVO
Juniper Junos OS Evolved 21.4-EVO before 21.4R3-S6-EVO, 22.1-EVO before 22.1R3-S4-EVO, 22.2-EVO before 22.2R3-S4-EVO
Juniper Junos OS Evolved 22.3-EVO before 22.3R3-S3-EVO, 22.4-EVO before 22.4R2-S2-EVO and 22.4R3-EVO

Discovery Timeline

2024-07-10 - CVE-2024-39559 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-39559

Vulnerability Analysis

The vulnerability resides in the TCP packet processing path used for sessions protected by TCP MD5 authentication (RFC 2385). When a specific packet arrives on an established, MD5-authenticated TCP session, the code path fails to handle an unusual condition correctly and the routing daemon or kernel component terminates, producing a vmcore. Because the code path involves synchronization between the primary and backup Routing Engines under Nonstop Active Routing, only dual RE systems with NSR enabled trigger the fault. The condition is a race between packet arrival and internal state transitions, so exploitation depends on timing outside attacker control. Repeated delivery of the packet keeps the device crashing after recovery, producing a sustained denial of service.

Root Cause

The root cause is an Improper Check for Unusual or Exceptional Conditions [CWE-754] in the packet handler for TCP sessions using MD5 authentication. The handler does not validate an internal state that can be observed only during a narrow window while NSR replicates TCP session state between Routing Engines. When the packet is processed during that window, an unexpected condition reaches code that assumes it cannot occur, causing a fatal error and a core dump.

Attack Vector

Exploitation requires network reachability to a TCP port on the device that hosts an established, MD5-authenticated session such as BGP. The attacker must be able to inject or send a specific TCP packet accepted by the MD5-authenticated session. No authentication to the device management plane is required, and no user interaction is needed. Because exploitation depends on a race condition, an attacker must send the packet repeatedly to hit the vulnerable window. Only dual-RE routers running Junos OS Evolved with NSR enabled are exploitable.

No public proof-of-concept exploit or verified sample code is available for this vulnerability. Refer to the Juniper Security Advisory JSA83019 for vendor technical details.

Detection Methods for CVE-2024-39559

Indicators of Compromise

Unexpected vmcore files generated on Routing Engines of Junos OS Evolved devices with NSR enabled.
Unplanned Routing Engine failovers or process restarts coinciding with BGP or other MD5-authenticated TCP session flaps.
Repeated crashes of the same daemon after service recovery, indicating sustained exploitation attempts.

Detection Strategies

Monitor Junos OS Evolved system logs for RPD_ crash events, kernel panics, and vmcore generation messages on dual-RE platforms.
Correlate BGP session resets on MD5-authenticated peers with device restarts to identify potential exploitation patterns.
Inspect flow telemetry for anomalous TCP traffic addressed to BGP or other MD5-protected listening ports from unexpected sources.

Monitoring Recommendations

Forward Junos OS Evolved syslog and SNMP trap data to a centralized analytics platform such as SentinelOne Singularity Data Lake for long-term correlation of crash events and network telemetry.
Alert on any generation of vmcore artifacts or on repeated chassisd and rpd restarts within short intervals.
Track BGP neighbor state transitions and route churn to detect denial-of-service impact against transit and peering sessions.

How to Mitigate CVE-2024-39559

Immediate Actions Required

Upgrade Junos OS Evolved to a fixed release: 21.2R3-S8-EVO, 21.4R3-S6-EVO, 22.1R3-S4-EVO, 22.2R3-S4-EVO, 22.3R3-S3-EVO, 22.4R2-S2-EVO, 22.4R3-EVO, or later.
Inventory dual-RE platforms with Nonstop Active Routing enabled and prioritize them for patching since only these systems are exploitable.
Restrict TCP access to BGP and other MD5-authenticated services using infrastructure access control lists that permit only trusted peer addresses.

Patch Information

Juniper Networks has released fixed versions of Junos OS Evolved that address CVE-2024-39559. Consult the Juniper Security Advisory JSA83019 for the complete list of remediated releases and upgrade procedures.

Workarounds

Where operationally acceptable, disable Nonstop Active Routing (NSR) to eliminate the vulnerable code path until fixed software is deployed.
Apply strict control-plane filters and BGP peer allow-lists to limit which sources can establish or send traffic to MD5-authenticated TCP sessions.
Enable BGP session monitoring and automated failover playbooks to reduce outage duration if a crash occurs.

bash

# Example: restrict BGP (TCP/179) to known peers on Junos OS Evolved
set firewall family inet filter protect-re term allow-bgp from source-address 203.0.113.10/32
set firewall family inet filter protect-re term allow-bgp from protocol tcp
set firewall family inet filter protect-re term allow-bgp from destination-port 179
set firewall family inet filter protect-re term allow-bgp then accept
set firewall family inet filter protect-re term deny-bgp from protocol tcp
set firewall family inet filter protect-re term deny-bgp from destination-port 179
set firewall family inet filter protect-re term deny-bgp then discard
set interfaces lo0 unit 0 family inet filter input protect-re