CVE-2022-22188 — Heap-based Buffer Overflow in Networks Junos OS

CWE-122 — Heap-based Buffer OverflowCWE-789 — Memory Allocation with Excessive Size Value4 documents4 sources
Severity
7.5HIGHNVD
EPSS
1.8%
top 17.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Juniper Networks Junos OSJuniper Junos
Timeline
PublishedApr 14
Latest updateApr 15

Description

An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer Overflow in the packet forwarding engine (PFE) of Juniper Networks Junos OS allows a network-based unauthenticated attacker to flood the device with traffic leading to a Denial of Service (DoS). The device must be configured with storm control profiling limiting the number of unknown broadcast, multicast, or unicast traffic to be vulnerable to this issue. This issue affects: Juniper Networks Junos OS on QFX5100/QFX511…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5juniper_networks/junos_os20.2R1 — 20.2*
▶NVDjuniper/junos20.2

🔴Vulnerability Details

2
GHSA
GHSA-vj9w-x659-cjhq: An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer Overflow in the packet forwarding engine (PFE) of Juniper Networks Juno↗2022-04-15
▶
CVEList
Junos OS: QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series: When storm control profiling is enabled and a device is under an active storm, a Heap-based Buffer Overflow in the PFE will caus↗2022-04-14
▶

📋Vendor Advisories

1
Juniper
CVE-2022-22188: An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer Overflow in the packet forwarding engine (PFE) of Juniper Networks Juno↗2022-04-14
▶
CVE-2022-22188 — Heap-based Buffer Overflow | cvebase