CVE-2023-22414Missing Release of Memory after Effective Lifetime in Networks Junos OS

Severity
6.5MEDIUMNVD
EPSS
0.1%
top 68.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJan 13

Description

A Missing Release of Memory after Effective Lifetime vulnerability in Flexible PIC Concentrator (FPC) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker from the same shared physical or logical network, to cause a heap memory leak and leading to FPC crash. On all Junos PTX Series and QFX10000 Series, when specific EVPN VXLAN Multicast packets are processed, an FPC heap memory leak is observed. The FPC memory usage can be monitored using the CLI command "show heap extensive

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

CVEListV5juniper_networks/junos_os20.220.2R3-S6+7
NVDjuniper/junos9 versions+8

🔴Vulnerability Details

2
GHSA
GHSA-phmh-wx44-p7vq: A Missing Release of Memory after Effective Lifetime vulnerability in Flexible PIC Concentrator (FPC) of Juniper Networks Junos OS allows an adjacent,2023-01-13
CVEList
Junos OS: PTX Series and QFX10000 Series: An FPC memory leak is observed when specific EVPN VXLAN Multicast packets are processed2023-01-12

📋Vendor Advisories

1
Juniper
CVE-2023-22414: A Missing Release of Memory after Effective Lifetime vulnerability in Flexible PIC Concentrator (FPC) of Juniper Networks Junos OS allows an adjacent,2023-01-13
CVE-2023-22414 — Networks Junos OS vulnerability | cvebase