CVE-2024-39564 Junos OS and Junos OS Evolved: Receipt of malformed BGP path attributes leads to RPD crash

High 8.7 Published 5 Feb 2025 Updated 26 Feb 2025

An attacker can cause a denial of service by sending malformed BGP updates that trigger a double-free crash in the routing daemon.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-39564?

CVE-2024-39564 is a high-severity use after free vulnerability in Juniper Junos, published on 5 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

This is a similar, but different vulnerability than the issue reported as CVE-2024-39549.

A double-free vulnerability in the routing process daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to send a malformed BGP Path attribute update which allocates memory used to log the bad path attribute. This double free of memory is causing an rpd crash, leading to a Denial of Service (DoS).

This issue affects:

Junos OS: * from 22.4 before 22.4R3-S4.

Junos OS Evolved: * from 22.4 before 22.4R3-S4-EVO.

Weakness: CWE-415

Which versions are affected by CVE-2024-39564?

It affects 2 products.

Products include Juniper Junos, Juniper Junos Os Evolved.

How do I fix CVE-2024-39564?

No fix has been published for CVE-2024-39564 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2024-39564 being exploited?

There is no known exploitation of CVE-2024-39564 in the wild and no public exploit code.

All Juniper Junos vulnerabilities

Sources

Also known as GHSA-6chq-9qg2-rx7f.