Juniper Networks Junos OS Incorrect Buffer Size Calculation Vulnerability in RPD Leading to Memory Corruption and Denial-of-Service

A vulnerability has been identified in Juniper Networks Junos OS routing protocol daemon (RPD) due to an incorrect calculation of buffer size. This flaw allows an adjacent unauthenticated attacker to cause memory corruption, leading to a crash of the RPD process. The issue arises when a logical interface using a routing instance experiences continuous flaps, prompting specific updates to be sent to the Jflow/Sflow modules. This sequence results in memory corruption, causing RPD to crash and restart. The ongoing receipt of these updates can create a sustained denial-of-service condition.

Impact

Exploitation of this vulnerability causes the RPD process to crash and restart, leading to a continuous denial-of-service condition on the affected device.

Remediation

Users can upgrade to Junos OS versions 21.2R3-S9, 22.4R3-S7, 23.2R2-S3, 23.4R2-S4, 24.2R2, 24.4R1, or any subsequent release to address this vulnerability.