CVE-2024-47494: Juniper Junos Race Condition Vulnerability

CVE-2024-47494 Overview

CVE-2024-47494 is a Time-of-check Time-of-use (TOCTOU) race condition [CWE-367] in the AgentD telemetry process of Juniper Networks Junos OS. An attacker who is already impacting established sessions can generate counter changes picked up by AgentD during telemetry polling. This drives AgentD into a state where it attempts to reap an already destroyed sensor, corrupting memory and crashing the Flexible PIC Concentrator (FPC). The result is a Denial of Service (DoS) on the affected line card. The FPC recovers automatically without user intervention. Junos OS Evolved is not affected.

Critical Impact
Sustained triggering of the race condition crashes the FPC, disrupting traffic forwarding on affected line cards and degrading network availability.

Affected Products

Juniper Junos OS: all versions before 21.4R3-S9
Juniper Junos OS: 22.2 before 22.2R3-S5, 22.3 before 22.3R3-S4, 22.4 before 22.4R3-S3
Juniper Junos OS: 23.2 before 23.2R2-S2, 23.4 before 23.4R2

Discovery Timeline

2024-10-11 - CVE-2024-47494 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47494

Vulnerability Analysis

The flaw lives in the AgentD process, which is responsible for polling telemetry counters from sensors registered on the FPC. During polling, AgentD checks whether a sensor is valid and then acts on it. Between the check and the use, the sensor can be destroyed by another concurrent event. When AgentD then attempts to reap the sensor object, it dereferences memory that no longer represents a valid sensor. This memory corruption crashes the FPC and interrupts forwarding.

The attacker must already be causing impact to established sessions that generate counter changes. Those counter changes are what AgentD observes during polling, which is what makes the race window reachable remotely across the network. Exploitation does not require authentication or user interaction, but attack complexity is high because the attacker must reliably win the race.

Root Cause

The root cause is a classic TOCTOU race [CWE-367] between sensor validation and sensor reaping inside AgentD. The process lacks proper synchronization to ensure that a sensor validated during telemetry polling still exists when it is subsequently accessed. When a sensor is destroyed between the two operations, AgentD operates on freed or invalid memory.

Attack Vector

The attack vector is network-based. An unauthenticated remote attacker who can influence traffic against established sessions on the device can generate the counter changes required to trigger the race condition in AgentD during its telemetry polling cycles. Successful exploitation causes the FPC to crash, resulting in a DoS condition on the affected forwarding hardware. No confidentiality or integrity impact is reported. No verified public exploit code is available at this time. Review the Juniper Security Advisory JSA88121 for authoritative technical details.

Detection Methods for CVE-2024-47494

Indicators of Compromise

Unexpected FPC crashes and automatic restarts on Junos OS devices running telemetry with AgentD enabled.
Crash traces or core files referencing the AgentD process and sensor reaping paths.
Repeated telemetry sensor destruction events correlated with elevated counter change activity on established sessions.

Detection Strategies

Monitor AgentD process state and FPC status via show chassis fpc and syslog messages such as FPC restart and AGENTD errors.
Correlate FPC crash events with traffic anomalies on established sessions to identify potential exploitation attempts.
Ingest Junos syslog and telemetry health events into a centralized analytics platform to alert on repeated FPC reboots within short windows.

Monitoring Recommendations

Forward Junos OS syslog and chassis alarms to your SIEM or data lake with rules for AGENTD faults and FPC crashes.
Track baselines for telemetry sensor churn and alert on abnormal creation and destruction rates.
Review upstream network telemetry to identify sources generating anomalous session or counter activity against affected devices.

How to Mitigate CVE-2024-47494

Immediate Actions Required

Identify all Junos OS devices running affected versions and inventory those with streaming telemetry and AgentD enabled.
Schedule upgrades to a fixed release as specified in Juniper Security Advisory JSA88121.
Restrict network exposure of affected devices so only trusted peers can establish sessions that generate telemetry-observed counters.

Patch Information

Juniper has released fixed software. Upgrade to Junos OS 21.4R3-S9, 22.2R3-S5, 22.3R3-S4, 22.4R3-S3, 23.2R2-S2, 23.4R2, or later. Junos OS Evolved is not affected. Consult Juniper Security Advisory JSA88121 for full version guidance.

Workarounds

No configuration-level workaround is published by the vendor; upgrading to a fixed release is the recommended remediation.
As a compensating control, limit the ability of untrusted networks to establish sessions that would generate counter changes observed by AgentD telemetry polling.
Where feasible, disable or scope streaming telemetry sensors to reduce the surface exposed by AgentD until patches are applied.

bash

# Configuration example: verify current version and upgrade
show version | match "Junos:"
request system software add /var/tmp/jinstall-host-<fixed-version>.tgz no-copy no-validate reboot