CVE-2024-21587
Assigner: juniper
Published: 2024-01-12T00:51:30.990Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: MX Series
product: Junos OS
vendor: Juniper Networks
versions: lessThan: 20.4R3-S9
status: affected
version: 0
versionType: semver
lessThan: 21.2R3-S7
status: affected
version: 21.2
versionType: semver
lessThan: 21.3R3-S5
status: affected
version: 21.3
versionType: semver
lessThan: 21.4R3-S5
status: affected
version: 21.4
versionType: semver
lessThan: 22.1R3-S4
status: affected
version: 22.1
versionType: semver
lessThan: 22.2R3-S3
status: affected
version: 22.2
versionType: semver
lessThan: 22.3R3-S2
status: affected
version: 22.3
versionType: semver
lessThan: 22.4R2-S2, 22.4R3
status: affected
version: 22.4
versionType: semver
lessThan: 23.2R1-S1, 23.2R2
status: affected
version: 23.2
versionType: semver
configurations: supportingMedia: base64: no
type: text/html
value: <p>DHCP liveness detection is enabled and configured as follows:</p><code>  [edit forwarding-options dhcp-relay]</code><br/><code>  user@host# edit liveness-detection</code><br/>
value: DHCP liveness detection is enabled and configured as follows:

  [edit forwarding-options dhcp-relay]
  user@host# edit liveness-detection

datePublic: 2024-01-10T17:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 

<p>An Improper Handling of Exceptional Conditions vulnerability in the broadband edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an attacker directly connected to the vulnerable system who repeatedly flaps DHCP subscriber sessions to cause a slow memory leak, ultimately leading to a Denial of Service (DoS). Memory can only be recovered by manually restarting bbe-smgd.</p><p>This issue only occurs if BFD liveness detection for DHCP subscribers is enabled. Systems without BFD liveness detection enabled are not vulnerable to this issue.</p><p>Indication of the issue can be observed by periodically executing the 'show system processes extensive' command, which will indicate an increase in memory allocation for bbe-smgd. A small amount of memory is leaked every time a DHCP subscriber logs in, which will become visible over time, ultimately leading to memory starvation.</p><code>user@junos&gt; show system processes extensive | match bbe-smgd</code><br><code>13071 root 24 0 415M 201M select 0 0:41 7.28% bbe-smgd{bbe-smgd}</code><br><code>13071 root 20 0 415M 201M select 1 0:04 0.00% bbe-smgd{bbe-smgd}</code><br><code>...</code><br><code>user@junos&gt; show system processes extensive | match bbe-smgd</code><br><code>13071 root 20 0 420M 208M select 0 4:33 0.10% bbe-smgd{bbe-smgd}</code><br><code>13071 root 20 0 420M 208M select 0 0:12 0.00% bbe-smgd{bbe-smgd}</code><br><code>...</code><br><p>This issue affects Juniper Networks Junos OS on MX Series:</p><p></p><ul><li>All versions earlier than 20.4R3-S9;</li><li>21.2 versions earlier than 21.2R3-S7;</li><li>21.3 versions earlier than 21.3R3-S5;</li><li>21.4 versions earlier than 21.4R3-S5;</li><li>22.1 versions earlier than 22.1R3-S4;</li><li>22.2 versions earlier than 22.2R3-S3;</li><li>22.3 versions earlier than 22.3R3-S2;</li><li>22.4 versions earlier than 22.4R2-S2, 22.4R3;</li><li>23.2 versions earlier than 23.2R1-S1, 23.2R2.</li></ul><p></p>


value: 
An Improper Handling of Exceptional Conditions vulnerability in the broadband edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an attacker directly connected to the vulnerable system who repeatedly flaps DHCP subscriber sessions to cause a slow memory leak, ultimately leading to a Denial of Service (DoS). Memory can only be recovered by manually restarting bbe-smgd.

This issue only occurs if BFD liveness detection for DHCP subscribers is enabled. Systems without BFD liveness detection enabled are not vulnerable to this issue.

Indication of the issue can be observed by periodically executing the 'show system processes extensive' command, which will indicate an increase in memory allocation for bbe-smgd. A small amount of memory is leaked every time a DHCP subscriber logs in, which will become visible over time, ultimately leading to memory starvation.

user@junos> show system processes extensive | match bbe-smgd
13071 root 24 0 415M 201M select 0 0:41 7.28% bbe-smgd{bbe-smgd}
13071 root 20 0 415M 201M select 1 0:04 0.00% bbe-smgd{bbe-smgd}
...
user@junos> show system processes extensive | match bbe-smgd
13071 root 20 0 420M 208M select 0 4:33 0.10% bbe-smgd{bbe-smgd}
13071 root 20 0 420M 208M select 0 0:12 0.00% bbe-smgd{bbe-smgd}
...
This issue affects Juniper Networks Junos OS on MX Series:



  *  All versions earlier than 20.4R3-S9;
  *  21.2 versions earlier than 21.2R3-S7;
  *  21.3 versions earlier than 21.3R3-S5;
  *  21.4 versions earlier than 21.4R3-S5;
  *  22.1 versions earlier than 22.1R3-S4;
  *  22.2 versions earlier than 22.2R3-S3;
  *  22.3 versions earlier than 22.3R3-S2;
  *  22.4 versions earlier than 22.4R2-S2, 22.4R3;
  *  23.2 versions earlier than 23.2R1-S1, 23.2R2.







exploits: supportingMedia: base64: no
type: text/html
value: <p>Juniper SIRT is not aware of any malicious exploitation of this vulnerability.</p>
value: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-755
description: CWE-755 Improper Handling of Exceptional Conditions
type: CWE
descriptions: description: Denial of Service (DoS)
solutions: supportingMedia: base64: no
type: text/html
value: <p>The following software releases have been updated to resolve this specific issue: Junos OS 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S3, 22.3R3-S2, 22.4R2-S2, 22.4R3, 23.2R1-S1, 23.2R2, 23.4R1, and all subsequent releases.</p>
value: The following software releases have been updated to resolve this specific issue: Junos OS 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S3, 22.3R3-S2, 22.4R2-S2, 22.4R3, 23.2R1-S1, 23.2R2, 23.4R1, and all subsequent releases.


source: advisory: JSA75725
defect: 1734564
discovery: USER
timeline: time: 2024-01-10T17:00:00.000Z
value: Initial Publication
title: Junos OS: MX Series: Memory leak in bbe-smgd process if BFD liveness detection for DHCP subscribers is enabled
workarounds: supportingMedia: base64: no
type: text/html
value: <p>This issue can be mitigated by disabling BFD liveness detection for DHCP subscribers.</p><p>Service can be restored by manually restarting the bbe-smgd process periodically.</p>
value: This issue can be mitigated by disabling BFD liveness detection for DHCP subscribers.

Service can be restored by manually restarting the bbe-smgd process periodically.


x_generator: engine: Vulnogram 0.1.0-av217