Can you explain this vulnerability to me?

This vulnerability is a Missing Release of Memory after Effective Lifetime issue in the Layer 2 Address Learning Daemon (l2ald) of Juniper Networks Junos OS and Junos OS Evolved.

It allows an adjacent, unauthenticated attacker to cause a memory leak by exploiting a logic issue in the l2ald memory management when handling routes learned from remote multi-homed Provider Edge (PE) devices in an EVPN-MPLS scenario.

Because memory allocated for these routes is not released properly during route churn, the l2ald process leaks memory, which ultimately leads to a crash and restart of the l2ald daemon.

Useful 0 Not Useful 0

How can this vulnerability impact me? :

The primary impact of this vulnerability is a Denial of Service (DoS) condition.

An attacker who is adjacent and unauthenticated can exploit the memory leak to cause the l2ald process to consume increasing amounts of memory until it crashes and restarts.

This crash and restart can disrupt network operations that depend on the l2ald daemon, potentially causing network instability or outages.

Useful 0 Not Useful 0

How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability can be detected by monitoring the memory consumption of the l2ald process on affected Juniper devices.

You can use the following command to check the memory usage of the l2ald process:

• show system process extensive | match "PID|l2ald"

Useful 0 Not Useful 0

What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, you should upgrade your Junos OS or Junos OS Evolved to a fixed version that addresses the memory leak issue in the l2ald process.

• For Junos OS, upgrade to versions 22.4R3-S5 or later, 23.2R2-S3 or later, 23.4R2-S4 or later, or 24.2R2 or later.
• For Junos OS Evolved, upgrade to versions 22.4R3-S5-EVO or later, 23.2R2-S3-EVO or later, 23.4R2-S4-EVO or later, or 24.2R2-EVO or later.

Additionally, monitor the memory consumption of the l2ald process using the command: show system process extensive | match "PID|l2ald" to detect abnormal memory usage that could indicate the vulnerability is being exploited.

Useful 0 Not Useful 0