CVE-2022-22166

Junos OS: An rpd core will occur if BGP update tracing is configured and an update containing a malformed BGP SR-TE policy tunnel attribute is received

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause an rdp crash and thereby a Denial of Service (DoS). If a BGP update message is received over an established BGP session where a BGP SR-TE policy tunnel attribute is malformed and BGP update tracing flag is enabled, the rpd will core. This issue can happen with any BGP session as long as the previous conditions are met. This issue can not propagate as the crash occurs as soon as the malformed update is received. This issue affects Juniper Networks Junos OS: 20.4 versions prior to 20.4R3-S1; 21.1 versions prior to 21.1R2-S2, 21.1R3. This issue does not affect Juniper Networks Junos OS versions prior to 20.4R1.

Una vulnerabilidad de comprobación inapropiada de la cantidad especificada en la entrada en el demonio del protocolo de enrutamiento (rpd) del Sistema Operativo Junos de Juniper Networks permite a un atacante no autenticado conectado a la red causar un bloqueo del rdp y, por tanto, una denegación de servicio (DoS). Si es recibido un mensaje de actualización de BGP a través de una sesión BGP establecida en la que un atributo de túnel de política SR-TE de BGP está malformado y la bandera de rastreo de actualizaciones de BGP está habilitada, el rpd será bloqueado. Este problema puede ocurrir con cualquier sesión BGP siempre que se cumplan las condiciones anteriores. Este problema no puede propagarse, ya que el fallo es producido en cuanto es recibido la actualización malformada. Este problema afecta al Sistema Operativo Junos de Juniper Networks: versiones 20.4 anteriores a 20.4R3-S1; versiones 21.1 anteriores a 21.1R2-S2, 21.1R3. Este problema no afecta a versiones del Sistema Operativo Junos de Juniper Networks anteriores a 20.4R1

*Credits: N/A

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Adjacent

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-12-21 CVE Reserved
2022-01-19 CVE Published
2024-08-18 EPSS Updated
2024-09-16 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-1284: Improper Validation of Specified Quantity in Input

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://kb.juniper.net/JSA11274	2023-06-27

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		-		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		r1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		r1-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		r2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		r2-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		r2-s2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				20.4 Search vendor "Juniper" for product "Junos" and version "20.4"		r3		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.1 Search vendor "Juniper" for product "Junos" and version "21.1"		-		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.1 Search vendor "Juniper" for product "Junos" and version "21.1"		r1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.1 Search vendor "Juniper" for product "Junos" and version "21.1"		r1-s1		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.1 Search vendor "Juniper" for product "Junos" and version "21.1"		r2		Affected
Juniper Search vendor "Juniper"		Junos Search vendor "Juniper" for product "Junos"				21.1 Search vendor "Juniper" for product "Junos" and version "21.1"		r2-s1		Affected