Vulnerability · Published Jul 20, 2022 · Assigned by juniper
CVE-2022-22210Junos OS: QFX5000 Series and MX Series: An l2alm crash leading to an FPC crash can be observed in VxLAN scenario
Medium 6.5
In plain English
A medium-severity null pointer dereference in Junos OS from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Official description
A NULL Pointer Dereference vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on QFX5000 Series and MX Series allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS). On QFX5K Series and MX Series, when the PFE receives a specific VxLAN packet the Layer 2 Address Learning Manager (L2ALM) process will crash leading to an FPC reboot. Continued receipt of this specific packet will create a sustained Denial of Service (DoS) condition. This issue affects Juniper Networks Junos OS on QFX5000 Series, MX Series: 20.3 versions prior to 20.3R3-S3; 20.4 versions prior to 20.4R3-S2; 21.2 versions prior to 21.2R2-S1. This issue does not affect Juniper Networks Junos OS: All versions prior to 20.3R1; 21.1 version 21.1R1 and later versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Juniper Networks | Junos OS | 20.3 – before 20.3R3-S320.4 – before 20.4R3-S221.2 – before 21.2R2-S1 |
| Juniper Networks | Junos OS | see references |
Weakness: CWE-476 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://kb.juniper.net/JSA69714 x_refsource_CONFIRM