An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a Denial of Service (DoS).
 

The issue is caused by malformed MLD packets looping on a multi-homed Ethernet Segment Identifier (ESI) when VXLAN is configured. These MLD packets received on a multi-homed ESI are sent to the peer, and then incorrectly forwarded out the same ESI, violating the split horizon rule.
 

This issue only affects QFX10K Series switches, including the QFX10002, QFX10008, and QFX10016. Other products and platforms are unaffected by this vulnerability.
 

This issue affects Juniper Networks Junos OS on QFX10K Series:

• All versions prior to 19.1R3-S9;
• 19.2 versions prior to 19.2R1-S9, 19.2R3-S5;
• 19.3 versions prior to 19.3R3-S6;
• 19.4 versions prior to 19.4R2-S7, 19.4R3-S8;
• 20.1 versions prior to 20.1R3-S4;
• 20.2 versions prior to 20.2R3-S4;
• 20.3 versions prior to 20.3R3-S2;
• 20.4 versions prior to 20.4R3-S2;
• 21.1 versions prior to 21.1R3;
• 21.2 versions prior to 21.2R2-S1, 21.2R3;
• 21.3 versions prior to 21.3R2.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was seen during production usage.

This issue has been assigned CVE-2022-22217.
 

The following software releases have been updated to resolve this specific issue: Junos OS 19.1R3-S9, 19.2R1-S9, 19.2R3-S5, 19.3R3-S6, 19.4R2-S7, 19.4R3-S8, 20.1R3-S4, 20.2R3-S4, 20.3R3-S2, 20.4R3-S2, 21.1R3, 21.2R2-S1, 21.2R3, 21.3R2, 21.4R1, and all subsequent releases.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).
 

This issue is being tracked as 1579014.
 

There are no viable workarounds for this issue.
 

Service may be temporarily restored by disabling/enabling the IRB interface affected by this issue. Note that this will cause a temporary service interruption as the interface is flapped.
 

2022-07-13: Initial publication
2022-07-20: corrected a typo at "19.4 versions prior to 19.4R2-S" (7 omitted), now it should be clear that 19.4R2 versions prior to 19.4R2-S7 are affected and 19.4R2-S7 is the resp. solution

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team