A Missing Release of Memory after Effective Lifetime vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). In a Juniper Flow Monitoring (jflow) scenario route churn that causes BGP next hops to be updated will cause a slow memory leak and eventually a crash and restart of rpd. Thread level memory utilization for the areas where the leak occurs can be checked using the below command: user@host> show task memory detail | match so_in so_in6 28 32 344450 11022400 344760 11032320 so_in 8 16 1841629 29466064 1841734 29467744 This issue affects: Junos OS * 21.4 versions earlier than 21.4R3; * 22.1 versions earlier than 22.1R3; * 22.2 versions earlie
The following software releases have been updated to resolve this specific issue: Junos OS: 21.4R3, 22.1R3, 22.2R3, 22.3R1, and all subsequent releases. Junos OS Evolved: 21.4R3-EVO, 22.1R3-EVO, 22.2R3-EVO, 22.3R1-EVO, and all subsequent releases.
Although not a workaround, it is advised to monitor the memory utilization proactively and when it reaches 85% of total RE memory, restart rpd or reboot the system.
| Product | Vulnerable range | Fixed version | Advisory |
|---|---|---|---|
| Juniper Networks Junos OS | >=21.4<21.4R3 | 21.4R3 | advisory ↗ |
| Juniper Networks Junos OS | >=22.1<22.1R3 | 22.1R3 | advisory ↗ |
| Juniper Networks Junos OS | >=22.2<22.2R3 | 22.2R3 | advisory ↗ |
| Juniper Networks Junos OS Evolved | >=21.4-EVO<21.4R3-EVO | 21.4R3-EVO | advisory ↗ |
| Juniper Networks Junos OS Evolved | >=22.1-EVO<22.1R3-EVO | 22.1R3-EVO | advisory ↗ |
| Juniper Networks Junos OS Evolved | >=22.2-EVO<22.2R3-EVO | 22.2R3-EVO | advisory ↗ |