Executive Summary

This vulnerability is a Missing Release of Memory after Effective Lifetime issue in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series devices.

It occurs when the authentication packet-type option is configured and a received packet does not match that packet type, causing a memory leak.

As memory is consumed and not released properly, eventually all available memory for bbe-smgd is exhausted.

When this happens, no new subscribers can log in, resulting in a Denial of Service (DoS).

Useful 0 Not Useful 0

Impact Analysis

An adjacent, unauthenticated attacker can exploit this vulnerability to cause a Denial of Service (DoS) on Junos OS MX Series devices.

By sending packets that do not match the configured authentication packet-type, the attacker triggers a memory leak in the bbe-smgd daemon.

Once the daemon's memory is exhausted, no new subscribers will be able to log in, potentially disrupting network services and connectivity.

Useful 0 Not Useful 0

Detection Guidance

The memory utilization of the bbe-smgd daemon can be monitored using the following command:

• show system processes extensive | match bbe-smgd

Additionally, you can look for the following log message which indicates that the memory limit has been reached:

• bbesmgd[<PID>]: %DAEMON-3-SMD_DPROF_RSMON_ERROR: Resource unavailability, Reason: Daemon Heap Memory exhaustion

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, monitor the memory utilization of the bbe-smgd process using the command: show system processes extensive | match bbe-smgd.

Be alert for the log message indicating memory exhaustion: bbesmgd[<PID>]: %DAEMON-3-SMD_DPROF_RSMON_ERROR: Resource unavailability, Reason: Daemon Heap Memory exhaustion.

Upgrade Junos OS on MX Series to a fixed version that addresses this issue. The affected versions are all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S5, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S2, 24.4 versions before 24.4R2, and 25.2 versions before 25.2R2.

Useful 0 Not Useful 0