CVE-2022-22188
Junos OS: QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series: When storm control profiling is enabled and a device is under an active storm, a Heap-based Buffer Overflow in the PFE will cause a device to hang.
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer Overflow in the packet forwarding engine (PFE) of Juniper Networks Junos OS allows a network-based unauthenticated attacker to flood the device with traffic leading to a Denial of Service (DoS). The device must be configured with storm control profiling limiting the number of unknown broadcast, multicast, or unicast traffic to be vulnerable to this issue. This issue affects: Juniper Networks Junos OS on QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series; 20.2 version 20.2R1 and later versions prior to 20.2R2. This issue does not affect: Juniper Networks Junos OS versions prior to 20.2R1.
Una vulnerabilidad de Asignación de Memoria no Controlada conllevando a un desbordamiento del búfer en la región Heap de la memoria en el motor de reenvío de paquetes (PFE) de Juniper Networks Junos OS permite a un atacante no autenticado basado en la red inundar el dispositivo con tráfico, conllevando a una Denegación de Servicio (DoS). El dispositivo debe estar configurado con un perfil de control de tormentas que limite el número de tráfico de difusión, multidifusión o unidifusión desconocido para ser vulnerable a este problema. Este problema afecta a: Juniper Networks Junos OS en las series QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650; versión 20.2 20.2R1 y versiones posteriores anteriores a 20.2R2. Este problema no afecta a: Juniper Networks Junos OS versiones anteriores a 20.2R1
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-12-21 CVE Reserved
- 2022-04-14 CVE Published
- 2023-09-25 EPSS Updated
- 2024-09-16 CVE Updated
- 2024-09-16 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-122: Heap-based Buffer Overflow
- CWE-789: Memory Allocation with Excessive Size Value
CAPEC
References (1)
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1 |
Affected
| in | Juniper Search vendor "Juniper" | Ex4600 Search vendor "Juniper" for product "Ex4600" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1 |
Affected
| in | Juniper Search vendor "Juniper" | Ex4650 Search vendor "Juniper" for product "Ex4650" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5100 Search vendor "Juniper" for product "Qfx5100" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5110 Search vendor "Juniper" for product "Qfx5110" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5120 Search vendor "Juniper" for product "Qfx5120" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5200 Search vendor "Juniper" for product "Qfx5200" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5210 Search vendor "Juniper" for product "Qfx5210" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s1 |
Affected
| in | Juniper Search vendor "Juniper" | Ex4600 Search vendor "Juniper" for product "Ex4600" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s1 |
Affected
| in | Juniper Search vendor "Juniper" | Ex4650 Search vendor "Juniper" for product "Ex4650" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5100 Search vendor "Juniper" for product "Qfx5100" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5110 Search vendor "Juniper" for product "Qfx5110" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5120 Search vendor "Juniper" for product "Qfx5120" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5200 Search vendor "Juniper" for product "Qfx5200" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s1 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5210 Search vendor "Juniper" for product "Qfx5210" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s2 |
Affected
| in | Juniper Search vendor "Juniper" | Ex4600 Search vendor "Juniper" for product "Ex4600" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s2 |
Affected
| in | Juniper Search vendor "Juniper" | Ex4650 Search vendor "Juniper" for product "Ex4650" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s2 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5100 Search vendor "Juniper" for product "Qfx5100" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s2 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5110 Search vendor "Juniper" for product "Qfx5110" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s2 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5120 Search vendor "Juniper" for product "Qfx5120" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s2 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5200 Search vendor "Juniper" for product "Qfx5200" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s2 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5210 Search vendor "Juniper" for product "Qfx5210" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s3 |
Affected
| in | Juniper Search vendor "Juniper" | Ex4600 Search vendor "Juniper" for product "Ex4600" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s3 |
Affected
| in | Juniper Search vendor "Juniper" | Ex4650 Search vendor "Juniper" for product "Ex4650" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s3 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5100 Search vendor "Juniper" for product "Qfx5100" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s3 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5110 Search vendor "Juniper" for product "Qfx5110" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s3 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5120 Search vendor "Juniper" for product "Qfx5120" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s3 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5200 Search vendor "Juniper" for product "Qfx5200" | - | - |
Safe
|
| Juniper Search vendor "Juniper" | Junos Search vendor "Juniper" for product "Junos" | 20.2 Search vendor "Juniper" for product "Junos" and version "20.2" | r1-s3 |
Affected
| in | Juniper Search vendor "Juniper" | Qfx5210 Search vendor "Juniper" for product "Qfx5210" | - | - |
Safe
|