Missing Release of Memory after Effective Lifetime Vulnerability in Routing Process Daemon (rpd) Could Lead to Denial of Service (DoS)

CVE-2024-39549

Summary

A vulnerability present in the Routing Protocol Daemon (rpd) within Juniper Networks' Junos OS and Junos OS Evolved occurs due to inadequate memory release after processing malformed BGP Path attribute updates. This flaw allows an attacker to exploit the system by sending these bad updates, resulting in allocated memory for logging that is not correctly freed under certain conditions. As a result, this can lead to resource exhaustion and potential Denial of Service (DoS) as the Routing Protocol Daemon does not manage the consumed memory effectively. Operators can monitor memory usage using commands like 'show system memory' or 'show system monitor memory status' and must restart the rpd manually to free the consumed memory.

References