Riskcovery

CVE-2022-22170

Junos OS: Specific packets over VXLAN cause FPC memory leak and ultimately reset

State
Published
Severity
7.5 High
Published
Jan 19, 2022
Updated
Sep 17, 2024
Reserved
Dec 21, 2021

Read the record on cve.org

Description

A Missing Release of Resource after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause a Denial of Service (DoS) by sending specific packets over VXLAN which cause heap memory to leak and on exhaustion the PFE to reset. The heap memory utilization can be monitored with the command: user@host> show chassis fpc This issue affects: Juniper Networks Junos OS 19.4 versions prior to 19.4R2-S6, 19.4R3-S6; 20.1 versions prior to 20.1R3-S2; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R2. This issue does not affect versions of Junos OS prior to 19.4R1.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hjuniper

Weaknesses

  • CWE-772 Missing Release of Resource after Effective Lifetime

Affected Products

ProductVersions
Junos OSJuniper Networks
  • before 19.4R1Not affected
  • 19.4 to before 19.4R2-S6, 19.4R3-S6Affected
  • 20.1 to before 20.1R3-S2Affected
  • 20.2 to before 20.2R3-S3Affected
  • 20.3 to before 20.3R3-S1Affected
  • 20.4 to before 20.4R3Affected
  • 21.1 to before 21.1R3Affected
  • 21.2 to before 21.2R2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.