Juniper Junos OS up to 23.2R1-S2 on MX IKE Daemon IPsec memory leak

Summaryinfo

A vulnerability was found in Juniper Junos OS up to 23.2R1-S2 on MX. It has been classified as critical. The impacted element is an unknown function of the component IKE Daemon. The manipulation of the argument IPsec leads to memory leak. This vulnerability is documented as CVE-2024-21609. The attack requires being on the local network. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Juniper Junos OS up to 23.2R1-S2 on MX. It has been rated as critical. This issue affects an unknown code block of the component IKE Daemon. The manipulation of the argument IPsec with an unknown input leads to a memory leak vulnerability. Using CWE to declare the problem leads to CWE-401. The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. Impacted is availability. The summary by CVE is:

A Missing Release of Memory after Effective Lifetime vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an administratively adjacent attacker which is able to successfully establish IPsec tunnels to cause a Denial of Service (DoS). If specific values for the IPsec parameters local-ip, remote-ip, remote ike-id, and traffic selectors are sent from the peer, a memory leak occurs during every IPsec SA rekey which is carried out with a specific message sequence. This will eventually result in an iked process crash and restart. The iked process memory consumption can be checked using the below command:   user@host> show system processes extensive | grep iked           PID USERNAME   PRI NICE   SIZE   RES   STATE   C TIME WCPU COMMAND           56903 root       31   0     4016M 2543M CPU0   0 2:10 10.50% iked This issue affects Juniper Networks Junos OS: * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S4; * 22.1 versions earlier than 22.1R3-S3; * 22.2 versions earlier than 22.2R3-S2; * 22.3 versions earlier than 22.3R3; * 22.4 versions earlier than 22.4R3; * 23.2 versions earlier than 23.2R1-S2, 23.2R2.

It is possible to read the advisory at supportportal.juniper.net. The identification of this vulnerability is CVE-2024-21609 since 12/27/2023. The exploitation is known to be easy. Access to the local network is required for this attack. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S4, 22.1R3-S3, 22.2R3-S2, 22.3R3, 22.4R3, 23.2R1-S2 or 23.2R2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

Version

• 20.4R3-S8
• 21.2R3-S6
• 21.3R3-S4
• 21.4R3-S3
• 22.1R3-S2
• 22.2R3-S1
• 22.3R2
• 22.4R2
• 23.2R1
• 23.2R1-S2

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion