CVE-2023-22406 — Missing Release of Memory after Effective Lifetime in Networks Junos OS
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 68.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJan 13
Description
A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). In a segment-routing scenario with OSPF as IGP, when a peer interface continuously flaps, next-hop churn will happen and a continuous increase in Routing Protocol Daemon (rpd) memory consumption will be observed. This will eventually lead to an rpd crash and restart when the memory is fu…
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6
Affected Packages4 packages
🔴Vulnerability Details
2GHSA▶
GHSA-hqm4-gqw3-f629: A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent,↗2023-01-13
CVEList▶
Junos OS and Junos OS Evolved: A memory leak which will ultimately lead to an rpd crash will be observed when a peer interface flaps continuously in a Segment Routing scenario using OSPF↗2023-01-12
📋Vendor Advisories
1Juniper▶
CVE-2023-22406: A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent,↗2023-01-13