title: Junos OS and Junos OS Evolved: In a jflow scenario continuous route churn will cause a memory leak and eventually an rpd crash
description:
A Missing Release of Memory after Effective Lifetime vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).
In a Juniper Flow Monitoring (jflow) scenario route churn that causes BGP next hops to be updated will cause a slow memory leak and eventually a crash and restart of rpd.
Thread level memory utilization for the areas where the leak occurs can be checked using the below command:
user@host> show task memory detail | match so_in
so_in6 28 32 344450 11022400 344760 11032320
so_in 8 16 1841629 29466064 1841734 29467744
This issue affects:
Junos OS
*  21.4 versions earlier than 21.4R3;
*  22.1 versions earlier than 22.1R3;
*  22.2 versions earlier than 22.2R3.
Junos OS Evolved
*  21.4-EVO versions earlier than 21.4R3-EVO;
*  22.1-EVO versions earlier than 22.1R3-EVO;
*  22.2-EVO versions earlier than 22.2R3-EVO.
This issue does not affect:
Juniper Networks Junos OS versions earlier than 21.4R1.
Juniper Networks Junos OS Evolved versions earlier than 21.4R1.
problem types: CWE-401 Missing Release of Memory after Effective Lifetime
affected:
{
defaultStatus: unaffected
product: Junos OS
vendor: Juniper Networks
versions:
lessThan: 21.4R3, status: affected, version: 21.4, versionType: semver
lessThan: 22.1R3, status: affected, version: 22.1, versionType: semver
lessThan: 22.2R3, status: affected, version: 22.2, versionType: semver
}
{
defaultStatus: unaffected
product: Junos OS Evolved
vendor: Juniper Networks
versions:
lessThan: 21.4R3-EVO, status: affected, version: 21.4-EVO, versionType: semver
lessThan: 22.1R3-EVO, status: affected, version: 22.1-EVO, versionType: semver
lessThan: 22.2R3-EVO, status: affected, version: 22.2-EVO, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: The following software releases have been updated to resolve this specific issue:
Junos OS: 21.4R3, 22.1R3, 22.2R3, 22.3R1, and all subsequent releases.
Junos OS Evolved: 21.4R3-EVO, 22.1R3-EVO, 22.2R3-EVO, 22.3R1-EVO, and all subsequent releases.
workarounds: Although not a workaround, it is advised to monitor the memory utilization proactively and when it reaches 85% of total RE memory, restart rpd or reboot the system.