2023-01 Security Bulletin: Junos OS and Junos OS Evolved: A memory leak which will ultimately lead to an rpd crash will be observed when a peer interface flaps continuously in a Segment Routing scenario (CVE-2023-22406)

Product Affected

This issue affects all versions of Junos OS and all versions of Junos OS Evolved.

Severity

Medium

Severity Assessment (CVSS) Score

6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Problem

A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).

In a segment-routing scenario with OSPF as IGP, when a peer interface continuously flaps, next-hop churn will happen and a continuous increase in Routing Protocol Daemon (rpd) memory consumption will be observed. This will eventually lead to an rpd crash and restart when the memory is full.

The memory consumption can be monitored using the CLI command "show task memory detail" as shown in the following example:

user@host> show task memory detail | match "RT_NEXTHOPS_TEMPLATE|RT_TEMPLATE_BOOK_KEE"
RT_NEXTHOPS_TEMPLATE 1008 1024 T 50 51200 50 51200
RT_NEXTHOPS_TEMPLATE 688 768 T 50 38400 50 38400
RT_NEXTHOPS_TEMPLATE 368 384 T 412330 158334720 412330 158334720
RT_TEMPLATE_BOOK_KEE 2064 2560 T 33315 85286400 33315 85286400

user@host> show task memory detail | match "RT_NEXTHOPS_TEMPLATE|RT_TEMPLATE_BOOK_KEE"
RT_NEXTHOPS_TEMPLATE 1008 1024 T 50 51200 50 51200
RT_NEXTHOPS_TEMPLATE 688 768 T 50 38400 50 38400
RT_NEXTHOPS_TEMPLATE 368 384 T 419005 160897920 419005 160897920 <===
RT_TEMPLATE_BOOK_KEE 2064 2560 T 39975 102336000 39975 10233600 <===

This issue affects:

Juniper Networks Junos OS

All versions prior to 19.3R3-S7;
19.4 versions prior to 19.4R2-S8, 19.4R3-S9;
20.2 versions prior to 20.2R3-S5;
20.3 versions prior to 20.3R3-S5;
20.4 versions prior to 20.4R3-S4;
21.1 versions prior to 21.1R3-S3;
21.2 versions prior to 21.2R3-S2;
21.3 versions prior to 21.3R3-S1;
21.4 versions prior to 21.4R2-S1, 21.4R3;
22.1 versions prior to 22.1R2.

Juniper Networks Junos OS Evolved

All versions prior to 20.4R3-S4-EVO;
21.4 versions prior to 21.4R2-S1-EVO, 21.4R3-EVO;
22.1 versions prior to 22.1R2-EVO.

To be exposed to this issue a minimal SR configuration for OSPF like in the following example is required:

[protocols ospf source-packet-routing}

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was seen during production usage.

This issue has been assigned CVE-2023-22406.

Solution

The following software releases have been updated to resolve this specific issue:

Junos OS: 19.3R3-S7, 19.4R2-S8, 19.4R3-S9, 20.2R3-S5, 20.3R3-S5, 20.4R3-S4, 21.1R3-S3, 21.2R3-S2, 21.3R3-S1, 21.4R2-S1, 21.4R3, 22.1R2, 22.2R1, and all subsequent releases.

Junos OS Evolved: 20.4R3-S4-EVO, 21.4R2-S1-EVO, 21.4R3-EVO, 22.1R2-EVO, 22.2R1-EVO, and all subsequent releases.

This issue is being tracked as 1659366.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Workaround

There are no known workarounds for this issue.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History