CVE-2024-39550

MEDIUM

Juniper Junos OS on MX Series with SPC3 - Unauthenticated Denial of Service via rtlogd Memory Leak

Title source: llm
STIX 2.1

Description

A Missing Release of Memory after Effective Lifetime vulnerability in the rtlogd process of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, adjacent attacker to trigger internal events cause ( which can be done by repeated port flaps) to cause a slow memory leak, ultimately leading to a Denial of Service (DoS). Memory can only be recovered by manually restarting rtlogd process.  The memory usage can be monitored using the below command.     user@host> show system processes extensive | match rtlog  This issue affects Junos OS on MX Series with SPC3 line card:  * from 21.2R3 before 21.2R3-S8,  * from 21.4R2 before 21.4R3-S6,  * from 22.1 before 22.1R3-S5,  * from 22.2 before 22.2R3-S3,  * from 22.3 before 22.3R3-S2,  * from 22.4 before 22.4R3-S1,  * from 23.2 before 23.2R2,  * from 23.4 before 23.4R2.

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory
https://supportportal.juniper.net/JSA83012

Scores

CVSS v3 6.5
EPSS 0.0019
EPSS Percentile 41.0%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-401
Status published
Products (6)
juniper/junos 21.2 r3 (8 CPE variants)
juniper/junos 21.4 r2 (9 CPE variants)
juniper/junos 22.1 (12 CPE variants)
juniper/junos 22.2 (10 CPE variants)
juniper/junos 22.3 (9 CPE variants)
juniper/junos 22.4 (2 CPE variants)
Published Jul 11, 2024
Tracked Since Feb 18, 2026