{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-21609", "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "state": "PUBLISHED", "assignerShortName": "juniper", "dateReserved": "2023-12-27T19:38:25.708Z", "datePublished": "2024-04-12T14:55:00.663Z", "dateUpdated": "2024-07-03T16:41:11.676Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["MX Series with SPC3", "SRX Series"], "product": "Junos OS", "vendor": "Juniper Networks", "versions": [{"lessThan": "20.4R3-S9", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "21.2R3-S7", "status": "affected", "version": "21.2", "versionType": "semver"}, {"lessThan": "21.3R3-S5", "status": "affected", "version": "21.3", "versionType": "semver"}, {"lessThan": "21.4R3-S4", "status": "affected", "version": "21.4", "versionType": "semver"}, {"lessThan": "22.1R3-S3", "status": "affected", "version": "22.1", "versionType": "semver"}, {"lessThan": "22.2R3-S2", "status": "affected", "version": "22.2", "versionType": "semver"}, {"lessThan": "22.3R3", "status": "affected", "version": "22.3", "versionType": "semver"}, {"lessThan": "22.4R3", "status": "affected", "version": "22.4", "versionType": "semver"}, {"lessThan": "23.2R1-S2, 23.2R2", "status": "affected", "version": "23.2", "versionType": "semver"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>To be exposed to this issue IPsec VPN needs to be configured with a minimal ike configuration:</p><p>&nbsp; [ security ike gateway ike-policy ]</p><p>&nbsp; [ security ipsec vpn ike gateway ]</p><p>and the system needs to run iked (vs. kmd which is not affected), which can be verified with:</p><p>&nbsp; show system processes extensive | match \"KMD|IKED\"</p>"}], "value": "To be exposed to this issue IPsec VPN needs to be configured with a minimal ike configuration:\n\n\u00a0 [ security ike gateway ike-policy ]\n\n\u00a0 [ security ipsec vpn ike gateway ]\n\nand the system needs to run iked (vs. kmd which is not affected), which can be verified with:\n\n\u00a0 show system processes extensive | match \"KMD|IKED\""}], "datePublic": "2024-04-10T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A Missing Release of Memory after Effective Lifetime vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an administratively adjacent attacker which is able to successfully establish IPsec tunnels to cause a Denial of Service (DoS).<br><br>If specific values for the IPsec parameters local-ip, remote-ip, remote ike-id, and traffic selectors are sent from the peer, a memory leak occurs during every IPsec SA rekey which is carried out with a specific message sequence. This will eventually result in an iked process crash and restart.<br><br>The iked process memory consumption can be checked using the below command:<br><tt>&nbsp; user@host&gt; show system processes extensive | grep iked<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PID USERNAME &nbsp; PRI NICE &nbsp; SIZE &nbsp; RES &nbsp; STATE &nbsp; C TIME WCPU COMMAND<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 56903 root &nbsp; &nbsp; &nbsp; 31 &nbsp; 0 &nbsp; &nbsp; 4016M 2543M CPU0 &nbsp; 0 2:10 10.50% iked</tt><br><br>This issue affects Juniper Networks Junos OS:<br><ul><li>All versions earlier than 20.4R3-S9;</li><li>21.2 versions earlier than 21.2R3-S7;</li><li>21.3 versions earlier than 21.3R3-S5;</li><li>21.4 versions earlier than 21.4R3-S4;</li><li>22.1 versions earlier than 22.1R3-S3;</li><li>22.2 versions earlier than 22.2R3-S2;</li><li>22.3 versions earlier than 22.3R3;</li><li>22.4 versions earlier than 22.4R3;</li><li>23.2 versions earlier than 23.2R1-S2, 23.2R2.</li></ul>"}], "value": "A Missing Release of Memory after Effective Lifetime vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an administratively adjacent attacker which is able to successfully establish IPsec tunnels to cause a Denial of Service (DoS).\n\nIf specific values for the IPsec parameters local-ip, remote-ip, remote ike-id, and traffic selectors are sent from the peer, a memory leak occurs during every IPsec SA rekey which is carried out with a specific message sequence. This will eventually result in an iked process crash and restart.\n\nThe iked process memory consumption can be checked using the below command:\n\u00a0 user@host> show system processes extensive | grep iked\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 PID USERNAME \u00a0 PRI NICE \u00a0 SIZE \u00a0 RES \u00a0 STATE \u00a0 C TIME WCPU COMMAND\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 56903 root \u00a0 \u00a0 \u00a0 31 \u00a0 0 \u00a0 \u00a0 4016M 2543M CPU0 \u00a0 0 2:10 10.50% iked\n\nThis issue affects Juniper Networks Junos OS:\n * All versions earlier than 20.4R3-S9;\n * 21.2 versions earlier than 21.2R3-S7;\n * 21.3 versions earlier than 21.3R3-S5;\n * 21.4 versions earlier than 21.4R3-S4;\n * 22.1 versions earlier than 22.1R3-S3;\n * 22.2 versions earlier than 22.2R3-S2;\n * 22.3 versions earlier than 22.3R3;\n * 22.4 versions earlier than 22.4R3;\n * 23.2 versions earlier than 23.2R1-S2, 23.2R2."}], "exploits": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Juniper SIRT is not aware of any malicious exploitation of this vulnerability.</p>"}], "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-401", "description": "CWE-401 Missing Release of Memory after Effective Lifetime", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"description": "Denial of Service (DoS)", "lang": "en"}]}], "providerMetadata": {"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper", "dateUpdated": "2024-05-16T20:09:32.000Z"}, "references": [{"tags": ["vendor-advisory"], "url": "http://supportportal.juniper.net/JSA75750"}, {"tags": ["technical-description"], "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The following software releases have been updated to resolve this specific issue: 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S4, 22.1R3-S3, 22.2R3-S2, 22.3R3, 22.4R3, 23.2R1-S2, 23.2R2, 23.4R1, and all subsequent releases.</p>"}], "value": "The following software releases have been updated to resolve this specific issue: 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S4, 22.1R3-S3, 22.2R3-S2, 22.3R3, 22.4R3, 23.2R1-S2, 23.2R2, 23.4R1, and all subsequent releases."}], "source": {"advisory": "JSA75750", "defect": ["1718199"], "discovery": "USER"}, "timeline": [{"lang": "en", "time": "2024-04-10T16:00:00.000Z", "value": "Initial Publication"}], "title": "Junos OS: MX Series with SPC3, and SRX Series: If specific IPsec parameters are negotiated iked will crash due to a memory leak", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>While there is no workaround available, customers can monitor the memory utilization and restart iked periodically to clear the leak.</p>"}], "value": "While there is no workaround available, customers can monitor the memory utilization and restart iked periodically to clear the leak."}], "x_generator": {"engine": "Vulnogram 0.1.0-av217"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-04-17T17:18:38.989630Z", "id": "CVE-2024-21609", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-03T16:41:11.676Z"}}]}}

{"descriptions": [{"lang": "en", "value": "A Missing Release of Memory after Effective Lifetime vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an administratively adjacent attacker which is able to successfully establish IPsec tunnels to cause a Denial of Service (DoS).\n\nIf specific values for the IPsec parameters local-ip, remote-ip, remote ike-id, and traffic selectors are sent from the peer, a memory leak occurs during every IPsec SA rekey which is carried out with a specific message sequence. This will eventually result in an iked process crash and restart.\n\nThe iked process memory consumption can be checked using the below command:\n\u00a0 user@host> show system processes extensive | grep iked\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 PID USERNAME \u00a0 PRI NICE \u00a0 SIZE \u00a0 RES \u00a0 STATE \u00a0 C TIME WCPU COMMAND\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 56903 root \u00a0 \u00a0 \u00a0 31 \u00a0 0 \u00a0 \u00a0 4016M 2543M CPU0 \u00a0 0 2:10 10.50% iked\n\nThis issue affects Juniper Networks Junos OS:\n * All versions earlier than 20.4R3-S9;\n * 21.2 versions earlier than 21.2R3-S7;\n * 21.3 versions earlier than 21.3R3-S5;\n * 21.4 versions earlier than 21.4R3-S4;\n * 22.1 versions earlier than 22.1R3-S3;\n * 22.2 versions earlier than 22.2R3-S2;\n * 22.3 versions earlier than 22.3R3;\n * 22.4 versions earlier than 22.4R3;\n * 23.2 versions earlier than 23.2R1-S2, 23.2R2."}, {"lang": "es", "value": "Una vulnerabilidad de liberaci\u00f3n de memoria faltante despu\u00e9s de la vida \u00fatil efectiva en el daemon IKE (iked) de Juniper Networks Junos OS en la serie MX con SPC3 y la serie SRX permite que un atacante administrativamente adyacente que pueda establecer con \u00e9xito t\u00faneles IPsec provoque una denegaci\u00f3n de servicio ( DoS). Si el par env\u00eda valores espec\u00edficos para los par\u00e1metros IPsec local-ip, remoto-ip, remoto ike-id y selectores de tr\u00e1fico, se produce una p\u00e9rdida de memoria durante cada nueva clave de IPsec SA que se lleva a cabo con una secuencia de mensajes espec\u00edfica. Esto eventualmente resultar\u00e1 en un bloqueo y reinicio del proceso iked. El consumo de memoria del proceso iked se puede verificar usando el siguiente comando: usuario@host&gt; mostrar procesos del sistema extensos | grep iked PID NOMBRE DE USUARIO PRI NICE TAMA\u00d1O RES ESTADO C HORA WCPU COMANDO 56903 root 31 0 4016M 2543M CPU0 0 2:10 10,50% iked Este problema afecta a Juniper Networks Junos OS: * Todas las versiones anteriores a 20.4R3-S9; * Versiones 21.2 anteriores a 21.2R3-S7; * Versiones 21.3 anteriores a 21.3R3-S5; * Versiones 21.4 anteriores a 21.4R3-S4; * Versiones 22.1 anteriores a 22.1R3-S3; * Versiones 22.2 anteriores a 22.2R3-S2; * Versiones 22.3 anteriores a 22.3R3; * Versiones 22.4 anteriores a 22.4R3; * Versiones 23.2 anteriores a 23.2R1-S2, 23.2R2."}], "id": "CVE-2024-21609", "lastModified": "2024-05-16T20:15:09.030", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "sirt@juniper.net", "type": "Primary"}]}, "published": "2024-04-12T15:15:23.770", "references": [{"source": "sirt@juniper.net", "url": "http://supportportal.juniper.net/JSA75750"}, {"source": "sirt@juniper.net", "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L"}], "sourceIdentifier": "sirt@juniper.net", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "sirt@juniper.net", "type": "Secondary"}]}

{}