Vulnerability · Published Oct 12, 2023 · Assigned by juniper
CVE-2023-44193Junos OS: MX Series: An FPC crash is observed when CFM is enabled in a VPLS scenario and a specific LDP related command is run
Medium 5.5
In plain English
A medium-severity memory leak in Junos OS from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
An Improper Release of Memory Before Removing Last Reference vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows a local, low privileged attacker to cause an FPC crash, leading to Denial of Service (DoS). On all Junos MX Series with MPC1 - MPC9, LC480, LC2101, MX10003, and MX80, when Connectivity-Fault-Management (CFM) is enabled in a VPLS scenario, and a specific LDP related command is run, an FPC will crash and reboot. Continued execution of this specific LDP command can lead to sustained Denial of Service condition. This issue affects: Juniper Networks Junos OS on MX Series: * All versions prior to 20.4R3-S7; * 21.1 versions prior to 21.1R3-S5; * 21.2 versions prior to 21.2R3-S4; * 21.3 versions prior to 21.3R3-S4; * 21.4 versions prior to 21.4R3-S3; * 22.1 versions prior to 22.1R3-S1; * 22.2 versions prior to 22.2R2-S1, 22.2R3; * 22.3 versions prior to 22.3R1-S2, 22.3R2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Juniper Networks | Junos OS | 0 – before 20.4R3-S721.1 – before 21.1R3-S521.2 – before 21.2R3-S421.3 – before 21.3R3-S421.4 – before 21.4R3-S322.1 – before 22.1R3-S122.2 – before 22.2R2-S1, 22.2R322.3 – before 22.3R1-S2, 22.3R2 |
Weakness: CWE-401 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://supportportal.juniper.net/JSA73157 vendor-advisory