2022-01 Security Bulletin: Junos OS: QFX5000 Series, EX4600: Device may run out of memory, causing traffic loss, upon receipt of specific packets (CVE-2022-22174)

Product Affected

This issue affects Junos OS 18.3, 18.4, 19.1, 19.2, 19.3, 19.4, 20.1, 20.2, 20.3, 20.4, 21.1, 21.2. Affected platforms: EX4600, QFX5000 Series.

Severity

High

Severity Assessment (CVSS) Score

7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Problem

A vulnerability in the processing of inbound IPv6 packets in Juniper Networks Junos OS on QFX5000 Series and EX4600 switches may cause the memory to not be freed, leading to a packet DMA memory leak, and eventual Denial of Service (DoS) condition. Once the condition occurs, further packet processing will be impacted, creating a sustained Denial of Service (DoS) condition.

The following error logs may be observed using the " show heap " command and the device may eventually run out of memory if such packets are received continuously.

Jan 12 12:00:00 device-name fpc0 (buf alloc) failed allocating packet buffer
Jan 12 12:00:01 device-name fpc0 (buf alloc) failed allocating packet buffer

user@device-name> request pfe execute target fpc0 timeout 30 command "show heap"
ID Base Total(b) Free(b) Used(b) % Name
-- ---------- ----------- ----------- ----------- --- -----------
0 246fc1a8 536870488 353653752 183216736 34 Kernel
1 91800000 16777216 12069680 4707536 28 DMA
2 92800000 75497472 69997640 5499832 7 PKT DMA DESC
3 106fc000 335544320 221425960 114118360 34 Bcm_sdk
4 97000000 176160768 200 176160568 99 Packet DMA
5 903fffe0 20971504 20971504 0 0 Blob

This issue affects Juniper Networks Junos OS on QFX5000 Series, EX4600:

18.3R3 versions prior to 18.3R3-S6;
18.4 versions prior to 18.4R2-S9, 18.4R3-S9;
19.1 versions prior to 19.1R2-S3, 19.1R3-S7;
19.2 versions prior to 19.2R1-S8, 19.2R3-S3;
19.3 versions prior to 19.3R2-S7, 19.3R3-S4;
19.4 versions prior to 19.4R2-S5, 19.4R3-S6;
20.1 versions prior to 20.1R3-S1;
20.2 versions prior to 20.2R3-S2;
20.3 versions prior to 20.3R3-S1;
20.4 versions prior to 20.4R3;
21.1 versions prior to 21.1R2-S1, 21.1R3;
21.2 versions prior to 21.2R1-S1, 21.2R2.

This issue does not affect Juniper Networks Junos OS:

Any versions prior to 17.4R3;
18.1 versions prior to 18.1R3-S6;
18.2 versions prior to 18.2R3;
18.3 versions prior to 18.3R3;
18.4 versions prior to 18.4R2;
19.1 versions prior to 19.1R2.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was seen during production usage.

This issue has been assigned CVE-2022-22174 .

Solution

The following software releases have been updated to resolve this specific issue: Junos OS 18.3R3-S6, 18.4R2-S9, 18.4R3-S9, 19.1R2-S3, 19.1R3-S7, 19.2R1-S8, 19.2R3-S3, 19.3R2-S7, 19.3R3-S4, 19.4R2-S5, 19.4R3-S6, 20.1R3-S1, 20.2R3-S2, 20.3R3-S1, 20.4R3, 21.1R2-S1, 21.1R3, 21.2R1-S1, 21.2R2, 21.3R1, 21.4R1, and all subsequent releases.

This issue is being tracked as 1603531 .

Software releases or updates are available for download at https://support.juniper.net/support/downloads/

Workaround

There are no viable workarounds for this issue.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History