CVE-2022-22249Improper Control of a Resource Through its Lifetime in Networks Junos OS

Severity
6.5MEDIUMNVD
EPSS
0.1%
top 71.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedOct 18

Description

An Improper Control of a Resource Through its Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS). When there is a continuous mac move a memory corruption causes one or more FPCs to crash and reboot. These MAC moves can be between two local interfaces or between core/EVPN and local interface. The below error logs can be seen in PFE syslog when this issue happens: xss_

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

CVEListV5juniper_networks/junos_osunspecified15.1R7-S13+11
NVDjuniper/junos< 15.1+12

🔴Vulnerability Details

2
GHSA
GHSA-hj7m-4fjj-fp55: An Improper Control of a Resource Through its Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series a2022-10-18
CVEList
Junos OS: MX Series: An FPC crash might be seen due to mac-moves within the same bridge domain2022-10-18

📋Vendor Advisories

1
Juniper
CVE-2022-22249: An Improper Control of a Resource Through its Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series a2022-10-18
CVE-2022-22249 — Networks Junos OS vulnerability | cvebase