CVE-2022-22188
Junos OS: QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series: When storm control profiling is enabled and a device is under an active storm, a Heap-based Buffer Overflow in the PFE will cause a device to hang.
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer Overflow in the packet forwarding engine (PFE) of Juniper Networks Junos OS allows a network-based unauthenticated attacker to flood the device with traffic leading to a Denial of Service (DoS). The device must be configured with storm control profiling limiting the number of unknown broadcast, multicast, or unicast traffic to be vulnerable to this issue. This issue affects: Juniper Networks Junos OS on QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series; 20.2 version 20.2R1 and later versions prior to 20.2R2. This issue does not affect: Juniper Networks Junos OS versions prior to 20.2R1.
Una vulnerabilidad de Asignación de Memoria no Controlada conllevando a un desbordamiento del búfer en la región Heap de la memoria en el motor de reenvío de paquetes (PFE) de Juniper Networks Junos OS permite a un atacante no autenticado basado en la red inundar el dispositivo con tráfico, conllevando a una Denegación de Servicio (DoS). El dispositivo debe estar configurado con un perfil de control de tormentas que limite el número de tráfico de difusión, multidifusión o unidifusión desconocido para ser vulnerable a este problema. Este problema afecta a: Juniper Networks Junos OS en las series QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650; versión 20.2 20.2R1 y versiones posteriores anteriores a 20.2R2. Este problema no afecta a: Juniper Networks Junos OS versiones anteriores a 20.2R1
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-12-21 CVE Reserved
- 2022-04-14 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-16 First Exploit
- 2024-11-18 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-122: Heap-based Buffer Overflow
- CWE-789: Memory Allocation with Excessive Size Value
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1 |
Affected
| in | Juniper Search vendor "Juniper" | Ex4600 Search vendor "Juniper" for product "Ex4600" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1 |
Affected
| in | Juniper Search vendor "Juniper" | Ex4650 Search vendor "Juniper" for product "Ex4650" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5100 Search vendor "Juniper" for product "Qfx5100" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5110 Search vendor "Juniper" for product "Qfx5110" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5120 Search vendor "Juniper" for product "Qfx5120" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5200 Search vendor "Juniper" for product "Qfx5200" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5210 Search vendor "Juniper" for product "Qfx5210" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s1 |
Affected
| in | Juniper Search vendor "Juniper" | Ex4600 Search vendor "Juniper" for product "Ex4600" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s1 |
Affected
| in | Juniper Search vendor "Juniper" | Ex4650 Search vendor "Juniper" for product "Ex4650" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5100 Search vendor "Juniper" for product "Qfx5100" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5110 Search vendor "Juniper" for product "Qfx5110" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5120 Search vendor "Juniper" for product "Qfx5120" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5200 Search vendor "Juniper" for product "Qfx5200" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5210 Search vendor "Juniper" for product "Qfx5210" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s2 |
Affected
| in | Juniper Search vendor "Juniper" | Ex4600 Search vendor "Juniper" for product "Ex4600" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s2 |
Affected
| in | Juniper Search vendor "Juniper" | Ex4650 Search vendor "Juniper" for product "Ex4650" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s2 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5100 Search vendor "Juniper" for product "Qfx5100" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s2 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5110 Search vendor "Juniper" for product "Qfx5110" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s2 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5120 Search vendor "Juniper" for product "Qfx5120" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s2 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5200 Search vendor "Juniper" for product "Qfx5200" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s2 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5210 Search vendor "Juniper" for product "Qfx5210" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s3 |
Affected
| in | Juniper Search vendor "Juniper" | Ex4600 Search vendor "Juniper" for product "Ex4600" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s3 |
Affected
| in | Juniper Search vendor "Juniper" | Ex4650 Search vendor "Juniper" for product "Ex4650" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s3 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5100 Search vendor "Juniper" for product "Qfx5100" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s3 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5110 Search vendor "Juniper" for product "Qfx5110" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s3 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5120 Search vendor "Juniper" for product "Qfx5120" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s3 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5200 Search vendor "Juniper" for product "Qfx5200" | - | - |
Safe
|
Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s3 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5210 Search vendor "Juniper" for product "Qfx5210" | - | - |
Safe
|