Log in Start free

Vulnerability · Published Jan 19, 2022 · Assigned by juniper

CVE-2022-22170Junos OS: Specific packets over VXLAN cause FPC memory leak and ultimately reset

High 7.5

In plain English

A high-severity security flaw in Junos OS from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.9%top 39.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A Missing Release of Resource after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause a Denial of Service (DoS) by sending specific packets over VXLAN which cause heap memory to leak and on exhaustion the PFE to reset. The heap memory utilization can be monitored with the command: user@host> show chassis fpc This issue affects: Juniper Networks Junos OS 19.4 versions prior to 19.4R2-S6, 19.4R3-S6; 20.1 versions prior to 20.1R3-S2; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R2. This issue does not affect versions of Junos OS prior to 19.4R1.

Affected products (as reported)

VendorProductVersions
Juniper Networks Junos OS 19.4 – before 19.4R2-S6, 19.4R3-S620.1 – before 20.1R3-S220.2 – before 20.2R3-S320.3 – before 20.3R3-S120.4 – before 20.4R321.1 – before 21.1R321.2 – before 21.2R2

Weakness: CWE-772 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References