CVE-2024-39547
📋 TL;DR
An unauthenticated network attacker can send crafted TCP traffic to Juniper Junos OS routing engines to cause CPU-based denial of service in the rpd-server process. This affects Junos OS and Junos OS Evolved with cRPD across multiple versions. The impact is more severe when RIB sharding is enabled.
💻 Affected Systems
- Juniper Junos OS
- Juniper Junos OS Evolved
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete control plane disruption causing network outages and loss of routing functionality across affected devices.
Likely Case
Degraded routing performance, increased latency, and potential service interruptions due to CPU exhaustion.
If Mitigated
Minimal impact with proper network segmentation and traffic filtering in place.
🎯 Exploit Status
Attack requires sending crafted TCP traffic to the routing engine control plane.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Junos OS: 21.2R3-S8, 21.4R3-S7, 22.1R3-S6, 22.2R3-S4, 22.3R3-S3, 22.4R3-S2, 23.2R2-S2, 24.2R2; Junos OS Evolved: 21.4R3-S7-EVO, 22.2R3-S4-EVO, 22.3R3-S3-EVO, 22.4R3-S2-EVO, 23.2R2-EVO
Vendor Advisory: https://supportportal.juniper.net/JSA88108
Restart Required: Yes
Instructions:
1. Download appropriate patch version from Juniper support portal. 2. Apply patch following Juniper upgrade procedures. 3. Reboot device to activate patched software.
🔧 Temporary Workarounds
Control Plane Protection
allImplement control plane protection policies to filter TCP traffic to routing engine.
set firewall family inet filter PROTECT-CP term BLOCK-TCP from protocol tcp
set firewall family inet filter PROTECT-CP term BLOCK-TCP then discard
Disable RIB Sharding
allDisable RIB sharding to reduce attack impact severity.
delete routing-options rib-sharding
🧯 If You Can't Patch
- Implement strict network segmentation to isolate routing engine from untrusted networks.
- Deploy intrusion prevention systems with signatures for crafted TCP traffic patterns.
🔍 How to Verify
Check if Vulnerable:
Check version with 'show version' and compare against affected versions list. Monitor for high CPU utilization in rpd-server process.Check Version:
show versionVerify Fix Applied:
Verify version is patched with 'show version' and monitor rpd-server CPU utilization under normal traffic conditions.📡 Detection & Monitoring
Log Indicators:
- High CPU utilization by rpd-server process
- Unexpected TCP connection attempts to routing engine
- Task accounting showing abnormal read operations by RPD Server jobs
Network Indicators:
- Crafted TCP packets targeting routing engine ports
- Unusual TCP traffic patterns to control plane interfaces
SIEM Query:
process_name:rpd-server AND cpu_usage:>80% OR tcp_dst_port:780 AND tcp_flags:malformed