CVE-2024-39557
📋 TL;DR
An unauthenticated adjacent attacker can exploit a memory leak in Juniper's Layer 2 Address Learning Daemon (l2ald) on Junos OS Evolved to cause system memory exhaustion, leading to a crash and denial of service. This affects Junos OS Evolved across multiple versions. The vulnerability requires network adjacency to the target device.
💻 Affected Systems
- Juniper Networks Junos OS Evolved
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash and restart causing extended network outage and service disruption until manual intervention.
Likely Case
Intermittent system crashes and restarts leading to network instability and degraded performance.
If Mitigated
Limited impact with proper network segmentation and monitoring to detect abnormal memory usage patterns.
🎯 Exploit Status
Exploitation requires adjacent network access but no authentication. The vulnerability is triggered by certain MAC table updates.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 21.4R3-S8-EVO, 22.2R3-S4-EVO, 22.3R3-S3-EVO, 22.4R3-EVO, 23.2R2-EVO or later
Vendor Advisory: https://supportportal.juniper.net/JSA83017
Restart Required: Yes
Instructions:
1. Download the appropriate patched version from Juniper's support portal. 2. Follow Juniper's standard upgrade procedures for Junos OS Evolved. 3. Reboot the device after installation.
🔧 Temporary Workarounds
Monitor memory usage
allRegularly check l2ald-agent memory allocations to detect abnormal patterns
show platform application-info allocations app l2ald-agent
🧯 If You Can't Patch
- Implement strict network segmentation to limit adjacent access to vulnerable devices
- Monitor system logs for memory exhaustion warnings and crash/restart events
🔍 How to Verify
Check if Vulnerable:
Run: show platform application-info allocations app l2ald-agent and check for high 'Live' counts on net::juniper::rtnh::L2Rtinfo objectsCheck Version:
show versionVerify Fix Applied:
Check version is patched with: show version and verify it matches fixed versions, then monitor l2ald-agent memory allocations📡 Detection & Monitoring
Log Indicators:
- System crash/restart logs
- Memory exhaustion warnings
- High l2ald-agent memory allocation counts
Network Indicators:
- Unusual MAC address flapping
- Increased layer 2 control traffic
SIEM Query:
Search for: 'l2ald-agent' AND ('memory' OR 'crash' OR 'restart')