// For flags

CVE-2022-22188

Junos OS: QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series: When storm control profiling is enabled and a device is under an active storm, a Heap-based Buffer Overflow in the PFE will cause a device to hang.

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer Overflow in the packet forwarding engine (PFE) of Juniper Networks Junos OS allows a network-based unauthenticated attacker to flood the device with traffic leading to a Denial of Service (DoS). The device must be configured with storm control profiling limiting the number of unknown broadcast, multicast, or unicast traffic to be vulnerable to this issue. This issue affects: Juniper Networks Junos OS on QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series; 20.2 version 20.2R1 and later versions prior to 20.2R2. This issue does not affect: Juniper Networks Junos OS versions prior to 20.2R1.

Una vulnerabilidad de Asignación de Memoria no Controlada conllevando a un desbordamiento del búfer en la región Heap de la memoria en el motor de reenvío de paquetes (PFE) de Juniper Networks Junos OS permite a un atacante no autenticado basado en la red inundar el dispositivo con tráfico, conllevando a una Denegación de Servicio (DoS). El dispositivo debe estar configurado con un perfil de control de tormentas que limite el número de tráfico de difusión, multidifusión o unidifusión desconocido para ser vulnerable a este problema. Este problema afecta a: Juniper Networks Junos OS en las series QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650; versión 20.2 20.2R1 y versiones posteriores anteriores a 20.2R2. Este problema no afecta a: Juniper Networks Junos OS versiones anteriores a 20.2R1

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-12-21 CVE Reserved
  • 2022-04-14 CVE Published
  • 2024-09-16 CVE Updated
  • 2024-09-16 First Exploit
  • 2024-11-18 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-122: Heap-based Buffer Overflow
  • CWE-789: Memory Allocation with Excessive Size Value
CAPEC
References (1)
URL Tag Source
URL Date SRC
https://kb.juniper.net/JSA69497 2024-09-16
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1
Affected
in Juniper
Search vendor "Juniper"
Ex4600
Search vendor "Juniper" for product "Ex4600"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1
Affected
in Juniper
Search vendor "Juniper"
Ex4650
Search vendor "Juniper" for product "Ex4650"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1
Affected
in Juniper
Search vendor "Juniper"
Qfx5100
Search vendor "Juniper" for product "Qfx5100"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1
Affected
in Juniper
Search vendor "Juniper"
Qfx5110
Search vendor "Juniper" for product "Qfx5110"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1
Affected
in Juniper
Search vendor "Juniper"
Qfx5120
Search vendor "Juniper" for product "Qfx5120"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1
Affected
in Juniper
Search vendor "Juniper"
Qfx5200
Search vendor "Juniper" for product "Qfx5200"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1
Affected
in Juniper
Search vendor "Juniper"
Qfx5210
Search vendor "Juniper" for product "Qfx5210"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s1
Affected
in Juniper
Search vendor "Juniper"
Ex4600
Search vendor "Juniper" for product "Ex4600"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s1
Affected
in Juniper
Search vendor "Juniper"
Ex4650
Search vendor "Juniper" for product "Ex4650"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s1
Affected
in Juniper
Search vendor "Juniper"
Qfx5100
Search vendor "Juniper" for product "Qfx5100"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s1
Affected
in Juniper
Search vendor "Juniper"
Qfx5110
Search vendor "Juniper" for product "Qfx5110"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s1
Affected
in Juniper
Search vendor "Juniper"
Qfx5120
Search vendor "Juniper" for product "Qfx5120"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s1
Affected
in Juniper
Search vendor "Juniper"
Qfx5200
Search vendor "Juniper" for product "Qfx5200"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s1
Affected
in Juniper
Search vendor "Juniper"
Qfx5210
Search vendor "Juniper" for product "Qfx5210"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s2
Affected
in Juniper
Search vendor "Juniper"
Ex4600
Search vendor "Juniper" for product "Ex4600"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s2
Affected
in Juniper
Search vendor "Juniper"
Ex4650
Search vendor "Juniper" for product "Ex4650"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s2
Affected
in Juniper
Search vendor "Juniper"
Qfx5100
Search vendor "Juniper" for product "Qfx5100"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s2
Affected
in Juniper
Search vendor "Juniper"
Qfx5110
Search vendor "Juniper" for product "Qfx5110"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s2
Affected
in Juniper
Search vendor "Juniper"
Qfx5120
Search vendor "Juniper" for product "Qfx5120"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s2
Affected
in Juniper
Search vendor "Juniper"
Qfx5200
Search vendor "Juniper" for product "Qfx5200"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s2
Affected
in Juniper
Search vendor "Juniper"
Qfx5210
Search vendor "Juniper" for product "Qfx5210"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s3
Affected
in Juniper
Search vendor "Juniper"
Ex4600
Search vendor "Juniper" for product "Ex4600"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s3
Affected
in Juniper
Search vendor "Juniper"
Ex4650
Search vendor "Juniper" for product "Ex4650"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s3
Affected
in Juniper
Search vendor "Juniper"
Qfx5100
Search vendor "Juniper" for product "Qfx5100"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s3
Affected
in Juniper
Search vendor "Juniper"
Qfx5110
Search vendor "Juniper" for product "Qfx5110"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s3
Affected
in Juniper
Search vendor "Juniper"
Qfx5120
Search vendor "Juniper" for product "Qfx5120"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s3
Affected
in Juniper
Search vendor "Juniper"
Qfx5200
Search vendor "Juniper" for product "Qfx5200"
--
Safe
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
20.2
Search vendor "Juniper" for product "Junos" and version "20.2"
r1-s3
Affected
in Juniper
Search vendor "Juniper"
Qfx5210
Search vendor "Juniper" for product "Qfx5210"
--
Safe