CVE-2023-22406Missing Release of Memory after Effective Lifetime in Networks Junos OS

Severity
6.5MEDIUMNVD
EPSS
0.1%
top 68.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJan 13

Description

A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). In a segment-routing scenario with OSPF as IGP, when a peer interface continuously flaps, next-hop churn will happen and a continuous increase in Routing Protocol Daemon (rpd) memory consumption will be observed. This will eventually lead to an rpd crash and restart when the memory is fu

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

CVEListV5juniper_networks/junos_os_evolvedunspecified20.4R3-S4-EVO+2
CVEListV5juniper_networks/junos_osunspecified19.3R3-S7+9
NVDjuniper/junos< 19.3+10

🔴Vulnerability Details

2
GHSA
GHSA-hqm4-gqw3-f629: A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent,2023-01-13
CVEList
Junos OS and Junos OS Evolved: A memory leak which will ultimately lead to an rpd crash will be observed when a peer interface flaps continuously in a Segment Routing scenario using OSPF2023-01-12

📋Vendor Advisories

1
Juniper
CVE-2023-22406: A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent,2023-01-13
CVE-2023-22406 — Networks Junos OS vulnerability | cvebase