CVE-2023-22402

published 2023-01-13

CVE-2023-22402: A Use After Free vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of…

Priority P4 32 medium 5.9 CVSS 3.1

AV N AC H PR N UI N S U C N I N A H

A Use After Free vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). In a Non Stop Routing (NSR) scenario, an unexpected kernel restart might be observed if "bgp auto-discovery" is enabled and if there is a BGP neighbor flap of auto-discovery sessions for any reason. This is a race condition which is outside of an attackers direct control and it depends on system internal timing whether this issue occurs. This issue affects Juniper Networks Junos OS Evolved: 21.3 versions prior to 21.3R3-EVO; 21.4 versions prior to 21.4R2-EVO; 22.1 versions prior to 22.1R2-EVO; 22.2 versions prior to 22.2R1-S1-EVO, 22.2R2-EVO.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
juniper	junos_os	—	—
juniper	junos_os_evolved	—	—
juniper	junos_os_evolved	—	—
juniper	junos_os_evolved	—	—
juniper	junos_os_evolved	—	—
juniper_networks	junos_os_evolved	>= 21.3 < 21.3R3-EVO	21.3R3-EVO
juniper_networks	junos_os_evolved	>= 21.4 < 21.4R2-EVO	21.4R2-EVO
juniper_networks	junos_os_evolved	>= 22.1 < 22.1R2-EVO	22.1R2-EVO
juniper_networks	junos_os_evolved	>= 22.2 < 22.2R1-S1-EVO, 22.2R2-EVO	22.2R1-S1-EVO, 22.2R2-EVO

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-416