{ "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", "CVE_data_meta": { "ID": "CVE-2024-21609", "ASSIGNER": "sirt@juniper.net", "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", "value": "A Missing Release of Memory after Effective Lifetime vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an administratively adjacent attacker which is able to successfully establish IPsec tunnels to cause a Denial of Service (DoS).\n\nIf specific values for the IPsec parameters local-ip, remote-ip, remote ike-id, and traffic selectors are sent from the peer, a memory leak occurs during every IPsec SA rekey which is carried out with a specific message sequence. This will eventually result in an iked process crash and restart.\n\nThe iked process memory consumption can be checked using the below command:\n\u00a0 user@host> show system processes extensive | grep iked\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 PID USERNAME \u00a0 PRI NICE \u00a0 SIZE \u00a0 RES \u00a0 STATE \u00a0 C TIME WCPU COMMAND\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 56903 root \u00a0 \u00a0 \u00a0 31 \u00a0 0 \u00a0 \u00a0 4016M 2543M CPU0 \u00a0 0 2:10 10.50% iked\n\nThis issue affects Juniper Networks Junos OS:\n * All versions earlier than 20.4R3-S9;\n * 21.2 versions earlier than 21.2R3-S7;\n * 21.3 versions earlier than 21.3R3-S5;\n * 21.4 versions earlier than 21.4R3-S4;\n * 22.1 versions earlier than 22.1R3-S3;\n * 22.2 versions earlier than 22.2R3-S2;\n * 22.3 versions earlier than 22.3R3;\n * 22.4 versions earlier than 22.4R3;\n * 23.2 versions earlier than 23.2R1-S2, 23.2R2." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-401 Missing Release of Memory after Effective Lifetime", "cweId": "CWE-401" } ] }, { "description": [ { "lang": "eng", "value": "Denial of Service (DoS)" } ] } ] }, "affects": { "vendor": { "vendor_data": [ { "vendor_name": "Juniper Networks", "product": { "product_data": [ { "product_name": "Junos OS", "version": { "version_data": [ { "version_affected": "<", "version_name": "0", "version_value": "20.4R3-S9" }, { "version_affected": "<", "version_name": "21.2", "version_value": "21.2R3-S7" }, { "version_affected": "<", "version_name": "21.3", "version_value": "21.3R3-S5" }, { "version_affected": "<", "version_name": "21.4", "version_value": "21.4R3-S4" }, { "version_affected": "<", "version_name": "22.1", "version_value": "22.1R3-S3" }, { "version_affected": "<", "version_name": "22.2", "version_value": "22.2R3-S2" }, { "version_affected": "<", "version_name": "22.3", "version_value": "22.3R3" }, { "version_affected": "<", "version_name": "22.4", "version_value": "22.4R3" }, { "version_affected": "<", "version_name": "23.2", "version_value": "23.2R1-S2, 23.2R2" } ] } } ] } } ] } }, "references": { "reference_data": [ { "url": "http://supportportal.juniper.net/JSA75750", "refsource": "MISC", "name": "http://supportportal.juniper.net/JSA75750" }, { "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L", "refsource": "MISC", "name": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L" } ] }, "generator": { "engine": "Vulnogram 0.1.0-av217" }, "source": { "advisory": "JSA75750", "defect": [ "1718199" ], "discovery": "USER" }, "configuration": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

To be exposed to this issue IPsec VPN needs to be configured with a minimal ike configuration:

  [ security ike gateway ike-policy ]

  [ security ipsec vpn ike gateway ]

and the system needs to run iked (vs. kmd which is not affected), which can be verified with:

  show system processes extensive | match \"KMD|IKED\"

" } ], "value": "To be exposed to this issue IPsec VPN needs to be configured with a minimal ike configuration:\n\n\u00a0 [ security ike gateway ike-policy ]\n\n\u00a0 [ security ipsec vpn ike gateway ]\n\nand the system needs to run iked (vs. kmd which is not affected), which can be verified with:\n\n\u00a0 show system processes extensive | match \"KMD|IKED\"" } ], "work_around": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

While there is no workaround available, customers can monitor the memory utilization and restart iked periodically to clear the leak.

" } ], "value": "While there is no workaround available, customers can monitor the memory utilization and restart iked periodically to clear the leak." } ], "exploit": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

" } ], "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability." } ], "solution": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

The following software releases have been updated to resolve this specific issue: 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S4, 22.1R3-S3, 22.2R3-S2, 22.3R3, 22.4R3, 23.2R1-S2, 23.2R2, 23.4R1, and all subsequent releases.

" } ], "value": "The following software releases have been updated to resolve this specific issue: 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S4, 22.1R3-S3, 22.2R3-S2, 22.3R3, 22.4R3, 23.2R1-S2, 23.2R2, 23.4R1, and all subsequent releases." } ], "impact": { "cvss": [ { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } ] } }