CVE-2024-21609

Summary

A Missing Release of Memory after Effective Lifetime vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an administratively adjacent attacker which is able to successfully establish IPsec tunnels to cause a Denial of Service (DoS).

If specific values for the IPsec parameters local-ip, remote-ip, remote ike-id, and traffic selectors are sent from the peer, a memory leak occurs during every IPsec SA rekey which is carried out with a specific message sequence. This will eventually result in an iked process crash and restart.

The iked process memory consumption can be checked using the below command:   user@host> show system processes extensive | grep iked           PID USERNAME   PRI NICE   SIZE   RES   STATE   C TIME WCPU COMMAND           56903 root       31   0     4016M 2543M CPU0   0 2:10 10.50% iked

This issue affects Juniper Networks Junos OS:

  • All versions earlier than 20.4R3-S9;
  • 21.2 versions earlier than 21.2R3-S7;
  • 21.3 versions earlier than 21.3R3-S5;
  • 21.4 versions earlier than 21.4R3-S4;
  • 22.1 versions earlier than 22.1R3-S3;
  • 22.2 versions earlier than 22.2R3-S2;
  • 22.3 versions earlier than 22.3R3;
  • 22.4 versions earlier than 22.4R3;
  • 23.2 versions earlier than 23.2R1-S2, 23.2R2.

Affected Software

VendorProductVersion RangeStatus
Juniper NetworksJunos OS0 < 20.4R3-S9affected
Juniper NetworksJunos OS21.2 < 21.2R3-S7affected
Juniper NetworksJunos OS21.3 < 21.3R3-S5affected
Juniper NetworksJunos OS21.4 < 21.4R3-S4affected
Juniper NetworksJunos OS22.1 < 22.1R3-S3affected
Juniper NetworksJunos OS22.2 < 22.2R3-S2affected
Juniper NetworksJunos OS22.3 < 22.3R3affected
Juniper NetworksJunos OS22.4 < 22.4R3affected
Juniper NetworksJunos OS23.2 < 23.2R1-S2, 23.2R2affected

Weaknesses

  • CWE-401: CWE-401 Missing Release of Memory after Effective Lifetime
  • Denial of Service (DoS)

Workarounds

While there is no workaround available, customers can monitor the memory utilization and restart iked periodically to clear the leak.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References