CVE-2024-39564

Description

This is a similar, but different vulnerability than the issue reported as CVE-2024-39549. A double-free vulnerability in the routing process daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to send a malformed BGP Path attribute update which allocates memory used to log the bad path attribute. This double free of memory is causing an rpd crash, leading to a Denial of Service (DoS). This issue affects: Junos OS:  * from 22.4 before 22.4R3-S4. Junos OS Evolved: * from 22.4 before 22.4R3-S4-EVO.

Reserved 2024-06-25 | Published 2025-02-05 | Updated 2025-02-26 | Assigner juniper

Problem types

CWE-415: Double Free

Product status

Default status
unaffected

22.4 before 22.4R3-S4
affected

Default status
unaffected

22.4 before 22.4R3-S3-EVO
affected

Credits

Juniper SIRT would like to acknowledge and thank Craig Dods (cdods@meta.com) from Meta for responsibly reporting this vulnerability. reporter

References

supportportal.juniper.net/JSA83011 vendor-advisory

cve.org (CVE-2024-39564)

nvd.nist.gov (CVE-2024-39564)

Download JSON