PT-2022-1474 · Juniper Networks · Junos

Published

2022-01-12

·

Updated

2023-07-24

·

CVE-2022-22155

CVSS v3.1

6.5

Medium

VectorAV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS on ACX5448 versions 18.4 through 18.4R3-S10 Juniper Networks Junos OS on ACX5448 versions 19.1 through 19.1R3-S5 Juniper Networks Junos OS on ACX5448 versions 19.2 through 19.2R1-S8 Juniper Networks Junos OS on ACX5448 versions 19.2 through 19.2R3-S2 Juniper Networks Junos OS on ACX5448 versions 19.3 through 19.3R2-S6 Juniper Networks Junos OS on ACX5448 versions 19.3 through 19.3R3-S2 Juniper Networks Junos OS on ACX5448 versions 19.4 through 19.4R1-S3 Juniper Networks Junos OS on ACX5448 versions 19.4 through 19.4R2-S2 Juniper Networks Junos OS on ACX5448 versions 19.4 through 19.4R3 Juniper Networks Junos OS on ACX5448 versions 20.1 through 20.1R2 Juniper Networks Junos OS on ACX5448 versions 20.2 through 20.2R1-S1 Juniper Networks Junos OS on ACX5448 versions 20.2 through 20.2R2
Description The issue is related to an Uncontrolled Resource Consumption vulnerability in the handling of IPv6 neighbor state change events in Juniper Networks Junos OS, allowing an adjacent attacker to cause a memory leak in the Flexible PIC Concentrator (FPC) of an ACX5448 router. This can lead to a Denial of Service (DoS) condition, requiring a manual PFE restart to restore service. The vulnerability is triggered by the continuous flapping of an IPv6 neighbor with specific timing, causing the FPC to run out of resources.
Recommendations For versions 18.4 through 18.4R3-S10, update to version 18.4R3-S10 or later. For versions 19.1 through 19.1R3-S5, update to version 19.1R3-S5 or later. For versions 19.2 through 19.2R1-S8, update to version 19.2R1-S8 or later. For versions 19.2 through 19.2R3-S2, update to version 19.2R3-S2 or later. For versions 19.3 through 19.3R2-S6, update to version 19.3R2-S6 or later. For versions 19.3 through 19.3R3-S2, update to version 19.3R3-S2 or later. For versions 19.4 through 19.4R1-S3, update to version 19.4R1-S3 or later. For versions 19.4 through 19.4R2-S2, update to version 19.4R2-S2 or later. For versions 19.4 through 19.4R3, update to version 19.4R3 or later. For versions 20.1 through 20.1R2, update to version 20.1R2 or later. For versions 20.2 through 20.2R1-S1, update to version 20.2R1-S1 or later. For versions 20.2 through 20.2R2, update to version 20.2R2 or later.

Fix

DoS

Resource Exhaustion

Missing Release of Resource after Effective Lifetime

Memory Leak

Weakness Enumeration

CWE-400CWE-772CWE-401

Related Identifiers

BDU:2022-00619
CVE-2022-22155

Affected Products

Junos