CVE-2024-21599

published 2024-01-12

CVE-2024-21599: A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an…

Priority P4 30 medium 6.5 CVSS 3.1

AV A AC L PR N UI N S U C N I N A H

A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).

If an MX Series device receives PTP packets on an MPC3E that doesn't support PTP this causes a memory leak which will result in unpredictable behavior and ultimately in an MPC crash and restart.

To monitor for this issue, please use the following FPC vty level commands:

show heap
shows an increase in "LAN buffer" utilization and

show clksync ptp nbr-upd-info
shows non-zero "Pending PFEs" counter.

This issue affects Juniper Networks Junos OS on MX Series with MPC3E:

* All versions earlier than 20.4R3-S3;
* 21.1 versions earlier than 21.1R3-S4;
* 21.2 versions earlier than 21.2R3;
* 21.3 versions earlier than 21.3R2-S1, 21.3R3;
* 21.4 versions earlier than 21.4R2;
* 22.1 versions earlier than 22.1R2.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos_os	—	—
juniper	mx_series	—	—
juniper_networks	junos_os	< 20.4R3-S3	20.4R3-S3
juniper_networks	junos_os	>= 21.1 < 21.1R3-S4	21.1R3-S4
juniper_networks	junos_os	>= 21.2 < 21.2R3	21.2R3
juniper_networks	junos_os	>= 21.3 < 21.3R2-S1, 21.3R3	21.3R2-S1, 21.3R3
juniper_networks	junos_os	>= 21.4 < 21.4R2	21.4R2
juniper_networks	junos_os	>= 22.1 < 22.1R2	22.1R2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-401