An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer Overflow in the packet forwarding engine (PFE) of Juniper Networks Junos OS allows a network-based unauthenticated attacker to flood the device with traffic leading to a Denial of Service (DoS). The device must be configured with storm control profiling limiting the number of unknown broadcast, multicast, or unicast traffic to be vulnerable to this issue.

This issue affects:

Juniper Networks Junos OS on QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series;

• 20.2 version 20.2R1 and later versions prior to 20.2R2.

This issue does not affect:

Juniper Networks Junos OS versions prior to 20.2R1.

The following is an example of the configuration required to be impacted by this issue.

Please refer to your documentation for specific configuration guidance:

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was found during internal product security testing or research.

This issue has been assigned CVE-2022-22188.

The following software releases have been updated to resolve this specific issue: 20.2R2, 20.3R1, and all subsequent releases.

This issue is being tracked as PR 1525821 which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).
 

Implementation

Software Releases, patches and updates are available at https://www.juniper.net/support/downloads/.

• 2022-04-13: Initial Publication.

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2022-22188 at cve.mitre.org