An Allocation of Resources Without Limits or Throttling weakness in the memory management of the Packet Forwarding Engine (PFE) on Juniper Networks Junos OS Evolved PTX10003 Series devices allows an adjacently located attacker who has established certain preconditions and knowledge of the environment to send certain specific genuine packets to begin a Time-of-check Time-of-use (TOCTOU) Race Condition attack which will cause a memory leak to begin. Once this condition begins, and as long as the attacker is able to sustain the offending traffic, a Distributed Denial of Service (DDoS) event occurs.

As a DDoS event, the offending packets sent by the attacker will continue to flow from one device to another as long as they are received and processed by any devices, ultimately causing a cascading outage to any vulnerable devices. Devices not vulnerable to the memory leak will process and forward the offending packet(s) to neighboring devices.

Due to internal anti-flood security controls and mechanisms reaching their maximum limit of response in the worst-case scenario, all affected Junos OS Evolved devices will reboot in as little as 1.5 days.

Reboots to restore services cannot be avoided once the memory leak begins. The device will self-recover after crashing and rebooting. Operator intervention isn't required to restart the device.

This issue affects:

• All versions prior to 20.4R3-S4-EVO;
• 21.3 versions prior to 21.3R3-S1-EVO;
• 21.4 versions prior to 21.4R2-S2-EVO, 21.4R3-EVO;
• 22.1 versions prior to 22.1R1-S2-EVO, 22.1R2-EVO;
• 22.2 versions prior to 22.2R2-EVO.

To check memory, customers may VTY to the PFE first then execute the following show statement:

Alternatively one may execute from the RE CLI:

Iteration 1:

Example output:

Iteration 2:

Example output:

The same can be seen in the CLI below, assuming the scale does not change:

Example output:

The following is the minimal configuration necessary to be affected by this issue:

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was seen during production usage.

This issue has been assigned CVE-2023-22397.

The following software releases have been updated to resolve these specific issues: Junos OS Evolved: 20.4R3-S4-EVO, 21.3R3-S1-EVO, 21.4R2-S2-EVO, 21.4R3-EVO, 22.1R1-S2-EVO, 22.1R2-EVO, 22.1R3-EVO, 22.2R1-S1-EVO, 22.2R2-EVO, 22.3R1-EVO, and all subsequent releases.

This issue is being tracked as 1670829.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

There are no known workarounds for this issue.

To reduce impact due to unplanned reboots customers may review memory thresholds as above and decide to reboot devices proactively to clear memory during planned maintenance windows.

• 2023-01-11: Initial Publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2023-22397 at cve.mitre.org