CVSS: 7.5EPSS: 0%CPEs: 86EXPL: 0CVE-2023-44192 – Junos OS: QFX5000 Series: DMA memory leak is observed when specific DHCP packets are transmitted over pseudo-VTEP
https://notcve.org/view.php?id=CVE-2023-44192
An Improper Input Validation vulnerability in the Packet Forwarding Engine of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause memory leak, leading to Denial of Service (DoS). On all Junos OS QFX5000 Series platforms, when pseudo-VTEP (Virtual Tunnel End Point) is configured under EVPN-VXLAN scenario, and specific DHCP packets are transmitted, DMA memory leak is observed. Continuous receipt of these specific DHCP packets will cause memory leak to reach 99% and then cause the protocols to stop working and traffic is impacted, leading to Denial of Service (DoS) condition. A manual reboot of the system recovers from the memory leak. To confirm the memory leak, monitor for "sheaf:possible leak" and "vtep not found" messages in the logs. This issue affects: Juniper Networks Junos OS QFX5000 Series: * All versions prior to 20.4R3-S6; * 21.1 versions prior to 21.1R3-S5; * 21.2 versions prior to 21.2R3-S5; * 21.3 versions prior to 21.3R3-S4; * 21.4 versions prior to 21.4R3-S3; * 22.1 versions prior to 22.1R3-S2; * 22.2 versions prior to 22.2R2-S2, 22.2R3; * 22.3 versions prior to 22.3R2-S1, 22.3R3; * 22.4 versions prior to 22.4R1-S2, 22.4R2. Una vulnerabilidad de validación de entrada incorrecta en Packet Forwarding Engine (PFE) de Juniper Networks Junos OS permite que un atacante basado en red no autenticado cause una pérdida de memoria, lo que lleva a una Denegación de Servicio (DoS). En todas las plataformas de la serie Junos OS QFX5000, cuando se configura pseudo-VTEP (Virtual Tunnel End Point) en el escenario EVPN-VXLAN y se transmiten paquetes DHCP específicos, se observa una pérdida de memoria DMA. • https://supportportal.juniper.net/JSA73156 • CWE-20: Improper Input Validation CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.5EPSS: 0%CPEs: 92EXPL: 0CVE-2023-44191 – Junos OS: QFX5000 Series and EX4000 Series: Denial of Service (DoS) on a large scale VLAN due to PFE hogging
https://notcve.org/view.php?id=CVE-2023-44191
An Allocation of Resources Without Limits or Throttling vulnerability in Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service (DoS). On all Junos OS QFX5000 Series and EX4000 Series platforms, when a high number of VLANs are configured, a specific DHCP packet will cause PFE hogging which will lead to dropping of socket connections. This issue affects: Juniper Networks Junos OS on QFX5000 Series and EX4000 Series * 21.1 versions prior to 21.1R3-S5; * 21.2 versions prior to 21.2R3-S5; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S4; * 22.1 versions prior to 22.1R3-S3; * 22.2 versions prior to 22.2R3-S1; * 22.3 versions prior to 22.3R2-S2, 22.3R3; * 22.4 versions prior to 22.4R2. This issue does not affect Juniper Networks Junos OS versions prior to 21.1R1 Una vulnerabilidad de asignación de recursos sin límites ni limitación en Juniper Networks Junos OS permite que un atacante no autenticado basado en la red provoque una Denegación de Servicio (DoS). En todas las plataformas Junos OS QFX5000 Series y EX4000 Series, cuando se configura una gran cantidad de VLAN, un paquete DHCP específico provocará un acaparamiento de PFE, lo que provocará la caída de las conexiones del socket. Este problema afecta a: Juniper Networks Junos OS en las series QFX5000 y EX4000 * versiones 21.1 anteriores a 21.1R3-S5; * Versiones 21.2 anteriores a 21.2R3-S5; * Versiones 21.3 anteriores a 21.3R3-S5; * Versiones 21.4 anteriores a 21.4R3-S4; * Versiones 22.1 anteriores a 22.1R3-S3; * Versiones 22.2 anteriores a 22.2R3-S1; * Versiones 22.3 anteriores a 22.3R2-S2, 22.3R3; * Versiones 22.4 anteriores a 22.4R2. Este problema no afecta a las versiones de Juniper Networks Junos OS anteriores a 21.1R1. • https://supportportal.juniper.net/JSA73155 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.5EPSS: 0%CPEs: 250EXPL: 0CVE-2023-44183 – Junos OS: QFX5000 Series, EX4600 Series: In a VxLAN scenario an adjacent attacker within the VxLAN sending genuine packets may cause a DMA memory leak to occur.
https://notcve.org/view.php?id=CVE-2023-44183
An Improper Input Validation vulnerability in the VxLAN packet forwarding engine (PFE) of Juniper Networks Junos OS on QFX5000 Series, EX4600 Series devices allows an unauthenticated, adjacent attacker, sending two or more genuine packets in the same VxLAN topology to possibly cause a DMA memory leak to occur under various specific operational conditions. The scenario described here is the worst-case scenario. There are other scenarios that require operator action to occur. An indicator of compromise may be seen when multiple devices indicate that FPC0 has gone missing when issuing a show chassis fpc command for about 10 to 20 minutes, and a number of interfaces have also gone missing. Use the following command to determine if FPC0 has gone missing from the device. show chassis fpc detail This issue affects: Juniper Networks Junos OS on QFX5000 Series, EX4600 Series: * 18.4 version 18.4R2 and later versions prior to 20.4R3-S8; * 21.1 version 21.1R1 and later versions prior to 21.2R3-S6; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S4; * 22.1 versions prior to 22.1R3-S3; * 22.2 versions prior to 22.2R3-S1; * 22.3 versions prior to 22.3R2-S2, 22.3R3; * 22.4 versions prior to 22.4R2. Una vulnerabilidad de validación de entrada incorrecta en Packet Forwarding Engine (PFE) VxLAN de Juniper Networks Junos OS en dispositivos de las series QFX5000 y EX4600 permite que un atacante adyacente no autenticado envíe dos o más paquetes genuinos en la misma topología VxLAN para causar posiblemente una memoria DMA que se produzca una fuga en diversas condiciones operativas específicas. El escenario descrito aquí es el peor de los casos. • https://supportportal.juniper.net/JSA73148 https://www.juniper.net/documentation/us/en/software/junos/evpn-vxlan/topics/topic-map/sdn-vxlan.html https://www.juniper.net/documentation/us/en/software/junos/multicast-l2/topics/topic-map/redundant-trunk-groups.html • CWE-20: Improper Input Validation CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.5EPSS: 0%CPEs: 92EXPL: 0CVE-2023-44181 – Junos OS: QFX5k: l2 loop in the overlay impacts the stability in a EVPN/VXLAN environment
https://notcve.org/view.php?id=CVE-2023-44181
An Improperly Implemented Security Check for Standard vulnerability in storm control of Juniper Networks Junos OS QFX5k devices allows packets to be punted to ARP queue causing a l2 loop resulting in a DDOS violations and DDOS syslog. This issue is triggered when Storm control is enabled and ICMPv6 packets are present on device. This issue affects Juniper Networks: Junos OS * All versions prior to 20.2R3-S6 on QFX5k; * 20.3 versions prior to 20.3R3-S5 on QFX5k; * 20.4 versions prior to 20.4R3-S5 on QFX5k; * 21.1 versions prior to 21.1R3-S4 on QFX5k; * 21.2 versions prior to 21.2R3-S3 on QFX5k; * 21.3 versions prior to 21.3R3-S2 on QFX5k; * 21.4 versions prior to 21.4R3 on QFX5k; * 22.1 versions prior to 22.1R3 on QFX5k; * 22.2 versions prior to 22.2R2 on QFX5k. Una verificación de seguridad implementada incorrectamente para una vulnerabilidad estándar en el control de tormentas de los dispositivos Junos OS QFX5k de Juniper Networks permite que los paquetes se envíen a la cola ARP, lo que provoca un bucle l2 que genera violaciones de DDOS y un registro del sistema DDOS. Este problema se activa cuando el control de tormentas está habilitado y hay paquetes ICMPv6 presentes en el dispositivo. Este problema afecta a Juniper Networks: Junos OS * Todas las versiones anteriores a 20.2R3-S6 en QFX5k; * Versiones 20.3 anteriores a 20.3R3-S5 en QFX5k; * Versiones 20.4 anteriores a 20.4R3-S5 en QFX5k; * Versiones 21.1 anteriores a 21.1R3-S4 en QFX5k; * Versiones 21.2 anteriores a 21.2R3-S3 en QFX5k; * Versiones 21.3 anteriores a 21.3R3-S2 en QFX5k; * Versiones 21.4 anteriores a 21.4R3 en QFX5k; * Versiones 22.1 anteriores a 22.1R3 en QFX5k; * Versiones 22.2 anteriores a 22.2R2 en QFX5k. • https://supportportal.juniper.net/JSA73145 https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/task/rate-limiting-storm-control-disabling-cli-els.html • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •