An Uncontrolled Resource Consumption vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause an FPC crash leading to a Denial of Service (DoS).
When a specific SNMP GET operation or a specific CLI command is executed this will cause a GUID resource leak, eventually leading to exhaustion and result in an FPC crash and reboot.
GUID exhaustion will trigger a syslog message like one of the following for example:
evo-pfemand[<pid>]: get_next_guid: Ran out of Guid Space ...
evo-aftmand-zx[<pid>]: get_next_guid: Ran out of Guid Space ...
This leak can be monitored by running the following command and taking note of the value in the rightmost column labeled Guids:
user@host> show platform application-info allocations app evo-pfemand | match "IFDId|IFLId|Context"
Node Application Context Name Live Allocs Fails Guids
re0 evo-pfemand net::juniper::interfaces::IFDId 0 3448 0 3448
re0 evo-pfemand net::juniper::interfaces::IFLId 0 561 0 561
re0 evo-pfemand net::juniper::interfaces::IFDId 0 3784 0 3784
re0 evo-pfemand net::juniper::interfaces::IFLId 0 647 0 647
This issue affects Juniper Networks Junos OS Evolved:
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
This issue was seen during production usage.
This issue has been assigned CVE-2023-22400.
The following software releases have been updated to resolve this specific issue: 20.4R3-S3-EVO, 21.2R3-S4-EVO, 21.4R2-EVO, 22.1R1-EVO, and all subsequent releases.
This issue is being tracked as 1641313.
Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).
There are no known workarounds for this issue.
To reduce the risk of exploitation of this issue, use access lists or firewall filters to limit access to only trusted networks, hosts and users.
2023-01-11: Initial Publication 2023-01-30: corrected the CVSS score from 5.5 to 7.5 (data at NVD was already correct)