CVE-2022-22191 — Insufficient Resource Pool in Networks Junos OS

CWE-410 — Insufficient Resource PoolCWE-400 — Uncontrolled Resource Consumption4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 57.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Juniper Networks Junos OSJuniper Junos
Timeline
PublishedApr 14
Latest updateApr 15

Description

A Denial of Service (DoS) vulnerability in the processing of a flood of specific ARP traffic in Juniper Networks Junos OS on the EX4300 switch, sent from the local broadcast domain, may allow an unauthenticated network-adjacent attacker to trigger a PFEMAN watchdog timeout, causing the Packet Forwarding Engine (PFE) to crash and restart. After the restart, transit traffic will be temporarily interrupted until the PFE is reprogrammed. In a virtual chassis (VC), the impacted Flexible PIC Concentra…

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5juniper_networks/junos_osunspecified — 15.1R7-S12+12
▶NVDjuniper/junos< 15.1+13

🔴Vulnerability Details

2
GHSA
GHSA-89j4-p5g9-qf6f: A Denial of Service (DoS) vulnerability in the processing of a flood of specific ARP traffic in Juniper Networks Junos OS on the EX4300 switch, sent f↗2022-04-15
▶
CVEList
Junos OS: EX4300: PFE Denial of Service (DoS) upon receipt of a flood of specific ARP traffic↗2022-04-14
▶

📋Vendor Advisories

1
Juniper
CVE-2022-22191: A Denial of Service (DoS) vulnerability in the processing of a flood of specific ARP traffic in Juniper Networks Junos OS on the EX4300 switch, sent f↗2022-04-14
▶
CVE-2022-22191 — Insufficient Resource Pool | cvebase