Main Vulnerability Database SB2022101272

SB2022101272 - Local denial of service in Junos OS on EX2300 and EX3400 series routers

Published: October 12, 2022 Updated: October 6, 2023

Security Bulletin ID SB2022101272

Severity

Low

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Local access

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 security vulnerability.

1) Resource management error (CVE-ID: CVE-2022-22234)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources in the Packet Forwarding Engine (PFE). If the device is very busy for example while executing a series of show commands on the CLI one or more SFPs might not be detected anymore. The system then changes its state to "unplugged" which is leading to traffic impact and at least a partial DoS. A local user can cause a high load for the device and perform a denial of service attack.

Remediation

Install update from vendor's website.

References

https://supportportal.juniper.net/s/article/2022-10-Security-Bulletin-Junos-OS-EX2300-and-EX3400-Series-One-of-more-SFPs-might-become-unavailable-when-the-system-is-very-busy-CVE-2022-22234