CVE-2024-21617
Assigner: juniper
Published: 2024-01-12T00:57:00.195Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: MX Series
PTX Series
ACX Series
EX Series
QFX Series
product: Junos OS
vendor: Juniper Networks
versions: lessThan: 21.2R3-S5
status: affected
version: 21.2
versionType: semver
lessThan: 21.3R3-S4
status: affected
version: 21.3
versionType: semver
lessThan: 21.4R3-S4
status: affected
version: 21.4
versionType: semver
lessThan: 22.1R3-S2
status: affected
version: 22.1
versionType: semver
lessThan: 22.2R3-S2
status: affected
version: 22.2
versionType: semver
lessThan: 22.3R2-S1, 22.3R3
status: affected
version: 22.3
versionType: semver
lessThan: 22.4R1-S2, 22.4R2
status: affected
version: 22.4
versionType: semver
lessThan: 20.4R3-S7
status: unaffected
version: 0
versionType: semver
configurations: supportingMedia: base64: no
type: text/html
value: <p>To be exposed to this issue non-stop routing (NSR) needs to be configured:</p><code>  [routing-options nonstop-routing]</code><br/>
value: To be exposed to this issue non-stop routing (NSR) needs to be configured:

  [routing-options nonstop-routing]

datePublic: 2024-01-10T17:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 

<p>An Incomplete Cleanup vulnerability in Nonstop active routing (NSR) component of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause memory leak leading to Denial of Service (DoS).</p><p>On all Junos OS platforms, when NSR is enabled, a BGP flap will cause memory leak. A manual reboot of the system will restore the services.</p>Note: NSR is not supported on the SRX Series and is therefore not affected by this vulnerability.<br><p>The memory usage can be monitored using the below commands.</p><code>user@host&gt; show chassis routing-engine no-forwarding</code><br><code>user@host&gt; show system memory | no-more</code><br><p>This issue affects:</p><p>Juniper Networks Junos OS</p><p></p><ul><li>21.2 versions earlier than 21.2R3-S5;</li><li>21.3 versions earlier than 21.3R3-S4;</li><li>21.4 versions earlier than 21.4R3-S4;</li><li>22.1 versions earlier than 22.1R3-S2;</li><li>22.2 versions earlier than 22.2R3-S2;</li><li>22.3 versions earlier than 22.3R2-S1, 22.3R3;</li><li>22.4 versions earlier than 22.4R1-S2, 22.4R2.</li></ul><p></p><p>This issue does not affect Junos OS versions earlier than 20.4R3-S7.</p>


value: 
An Incomplete Cleanup vulnerability in Nonstop active routing (NSR) component of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause memory leak leading to Denial of Service (DoS).

On all Junos OS platforms, when NSR is enabled, a BGP flap will cause memory leak. A manual reboot of the system will restore the services.

Note: NSR is not supported on the SRX Series and is therefore not affected by this vulnerability.
The memory usage can be monitored using the below commands.

user@host> show chassis routing-engine no-forwarding
user@host> show system memory | no-more
This issue affects:

Juniper Networks Junos OS



  *  21.2 versions earlier than 21.2R3-S5;
  *  21.3 versions earlier than 21.3R3-S4;
  *  21.4 versions earlier than 21.4R3-S4;
  *  22.1 versions earlier than 22.1R3-S2;
  *  22.2 versions earlier than 22.2R3-S2;
  *  22.3 versions earlier than 22.3R2-S1, 22.3R3;
  *  22.4 versions earlier than 22.4R1-S2, 22.4R2.




This issue does not affect Junos OS versions earlier than 20.4R3-S7.




exploits: supportingMedia: base64: no
type: text/html
value: <p>Juniper SIRT is not aware of any malicious exploitation of this vulnerability.</p>
value: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-459
description: CWE-459 Incomplete Cleanup
type: CWE
descriptions: description: Denial of Service (DoS)
solutions: supportingMedia: base64: no
type: text/html
value: <p>The following software releases have been updated to resolve this specific issue: Junos OS 21.2R3-S5, 21.3R3-S4, 21.4R3-S4, 22.1R3-S2, 22.2R3-S2, 22.3R2-S1, 22.3R3, 22.4R1-S2, 22.4R2, 23.2R1, and all subsequent releases.</p>
value: The following software releases have been updated to resolve this specific issue: Junos OS 21.2R3-S5, 21.3R3-S4, 21.4R3-S4, 22.1R3-S2, 22.2R3-S2, 22.3R2-S1, 22.3R3, 22.4R1-S2, 22.4R2, 23.2R1, and all subsequent releases.


source: advisory: JSA75758
defect: 1711656
discovery: USER
timeline: time: 2024-01-10T17:00:00.000Z
value: Initial Publication
time: 2024-01-23T17:00:00.000Z
value: Clarified that the SRX Series does not support NSR, and is therefore not affected by this vulnerability
title: Junos OS: BGP flap on NSR-enabled devices causes memory leak
workarounds: supportingMedia: base64: no
type: text/html
value: <p>There are no known workarounds for this issue.</p>
value: There are no known workarounds for this issue.


x_generator: engine: Vulnogram 0.1.0-av217