PT-2022-5201 · Juniper Networks · Junos Evolved

Published 2022-10-12 · Updated 2022-10-21 · CVE-2022-22211

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS Evolved on PTX Series versions prior to 20.4R3-S4-EVO Juniper Networks Junos OS Evolved on PTX Series version 21.1R1-EVO and later versions Juniper Networks Junos OS Evolved on PTX Series version 21.2R1-EVO and later versions Juniper Networks Junos OS Evolved on PTX Series versions prior to 21.3R3-EVO Juniper Networks Junos OS Evolved on PTX Series versions prior to 21.4R2-EVO Juniper Networks Junos OS Evolved on PTX Series versions prior to 22.1R2-EVO

Description A limitless resource allocation vulnerability in FPC resources of Juniper Networks Junos OS Evolved on PTX Series allows an unprivileged attacker to cause Denial of Service (DoS). Continuously polling the SNMP jnxCosQstatTable causes the FPC to run out of GUID space, causing a Denial of Service to the FPC resources. When the FPC runs out of the GUID space, specific syslog messages are generated. The FPC resources can be monitored using the command show platform application-info allocations app evo-aftmand-bt. Once the FPCs become unreachable, they must be manually restarted as they do not self-recover.

Recommendations For versions prior to 20.4R3-S4-EVO, update to version 20.4R3-S4-EVO or later. For version 21.1R1-EVO and later versions, update to version 21.3R3-EVO or later. For version 21.2R1-EVO and later versions, update to version 21.3R3-EVO or later. For versions prior to 21.3R3-EVO, update to version 21.3R3-EVO or later. For versions prior to 21.4R2-EVO, update to version 21.4R2-EVO or later. For versions prior to 22.1R2-EVO, update to version 22.1R2-EVO or later. As a temporary workaround, consider restricting access to the jnxCosQstatTable to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2022-06458

CVE-2022-22211

Affected Products

Junos Evolved

References · 5

• https://bdu.fstec.ru/vul/2022-06458 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22211 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22211 · Vendor Advisory
• https://vuldb.com/?id.211099 · Note
• https://kb.juniper.net/JSA69916 · Note