CVE-2022-22170CWE-772

Junos OS: Specific packets over VXLAN cause FPC memory leak and ultimately reset

High · published January 19, 2022

CVSS v3.1
7.5
EPSS
1%
Percentile
60.2
In the wild
Unconfirmed
What it is

A Missing Release of Resource after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause a Denial of Service (DoS) by sending specific packets over VXLAN which cause heap memory to leak and on exhaustion the PFE to reset. The heap memory utilization can be monitored with the command: user@host> show chassis fpc This issue affects: Juniper Networks Junos OS 19.4 versions prior to 19.4R2-S6, 19.4R3-S6; 20.1 versions prior to 20.1R3-S2; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R2. This issue does not affect versions of Junos OS prior to 19.4R1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00930 · 60.2th percentile
Weakness
CWE-772 · Missing Release of Resource after Effective Lifetime
Published
2022-01-19T00:21Z
EPSS history
Timeline
  • 19 JAN 00:21Z
    Junos OS: Specific packets over VXLAN cause FPC memory leak and ultimately reset
    cvelistv5