PT-2023-3065 · Juniper Networks · Junos Evolved

Published 2023-01-11 · Updated 2023-01-20 · CVE-2023-22402

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS Evolved versions 21.3 prior to 21.3R3-EVO Juniper Networks Junos OS Evolved versions 21.4 prior to 21.4R2-EVO Juniper Networks Junos OS Evolved versions 22.1 prior to 22.1R2-EVO Juniper Networks Junos OS Evolved versions 22.2 prior to 22.2R1-S1-EVO, 22.2R2-EVO

Description A Use After Free vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). This issue may be observed in a Non Stop Routing (NSR) scenario, where an unexpected kernel restart might occur if "bgp auto-discovery" is enabled and there is a BGP neighbor flap of auto-discovery sessions. The occurrence of this issue depends on system internal timing and is outside of an attacker's direct control.

Recommendations For versions 21.3 prior to 21.3R3-EVO, update to version 21.3R3-EVO or later. For versions 21.4 prior to 21.4R2-EVO, update to version 21.4R2-EVO or later. For versions 22.1 prior to 22.1R2-EVO, update to version 22.1R2-EVO or later. For versions 22.2 prior to 22.2R1-S1-EVO, 22.2R2-EVO, update to version 22.2R1-S1-EVO, 22.2R2-EVO or later.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2023-03134

CVE-2023-22402

Affected Products

Junos Evolved

References · 4

• https://kb.juniper.net/JSA70198 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22402 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22402 · Security Note
• https://bdu.fstec.ru/vul/2023-03134 · Security Note