Main Vulnerability Database Vulnerabilities #VU68366

Memory leak in Junos OS - CVE-2022-22228

Published: October 17, 2022

Vulnerability identifier: #VU68366

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-22228

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in the routing protocol daemon (rpd). A remote attacker can send specially crafted IPv6 packets to any configured IPv6 address on the device, trigger RPD memory leak and perform denial of service attack.

Affected software

Junos OS

How to mitigate CVE-2022-22228

Install updates from vendor's website.

Junos OS - addressed in versions 21.1R3-S2, 21.2R3-S1, 21.3R3, 21.4R2, 22.1R2, 22.2R1

External References

https://supportportal.juniper.net/s/article/2022-10-Security-Bulletin-Junos-OS-On-IPv6-OAM-SRv6-network-enabled-devices-an-attacker-sending-a-specific-genuine-packet-to-an-IPv6-address-configured-on-the-device-may-cause-a-RPD-memory-leak-leading-to-an-RPD-core-CVE-2022-22228

Related Security Bulletins