CVE-2024-21594

/// Technical description

A Heap-based Buffer Overflow vulnerability in the Network Services Daemon (NSD) of Juniper Networks Junos OS allows authenticated, low privileged, local attacker to cause a Denial of Service (DoS).

On an SRX 5000 Series device, when executing a specific command repeatedly, memory is corrupted, which leads to a Flow Processing Daemon (flowd) crash.

The NSD process has to be restarted to restore services.

If this issue occurs, it can be checked with the following command:

user@host> request security policies check

The following log message can also be observed:

Error: policies are out of sync for PFE node<number>.fpc<number>.pic<number>.

This issue affects:

Juniper Networks Junos OS on SRX 5000 Series

* All versions earlier than 20.4R3-S6;

* 21.1 versions earlier than 21.1R3-S5;

* 21.2 versions earlier than 21.2R3-S4;

* 21.3 versions earlier than 21.3R3-S3;

* 21.4 versions earlier than 21.4R3-S3;

* 22.1 versions earlier than 22.1R3-S1;

* 22.2 versions earli

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References