A Missing Release of Memory after Effective Lifetime vulnerability in the Juniper Networks Junos OS on MX Series platforms with MPC10/MPC11 line cards, allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS).
Devices are only vulnerable when the Suspicious Control Flow Detection (scfd) feature is enabled.
Upon enabling this specific feature, an attacker sending specific traffic is causing memory to be allocated dynamically and it is not freed. Memory is not freed even after deactivating this feature. Sustained processing of such traffic will eventually lead to an out of memory condition that prevents all services from continuing to function, and requires a manual restart to recover.
The FPC memory usage can be monitored using the CLI command "show chassis fpc".
On running the above command, the memory leak can be seen by observing the third column.Before:
Node Add Rate(ps) Update Rate(ps) Delete Rate(ps) Bind Fail Create Fail Out of Order pOut Of Order AftDdos 258 0 421 0 0 0 0 0 0 0 AftDdosScfdFlow 1 0 199 0 0 0 0 0 0 0
After:
Node Add Rate(ps) Update Rate(ps) Delete Rate(ps) Bind Fail Create Fail Out of Order pOut Of Order AftDdosScfdFlow 1 0 11054 12 0 0 0 0 0 0 AftDdosScfdFlow 1 0 14847 0 0 0 0 0 0 0
This issue affects Juniper Networks Junos OS on MX Series:
This issue only affects systems with scfd enabled. An minimal scfd configuration is shown below:
[system ddos-protection global flow-detection]
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
This issue was seen during production usage.
This issue has been assigned CVE-2023-22410.
The following software releases have been updated to resolve this specific issue: 20.2R3-S5, 20.4R1, and all subsequent releases.
This issue is being tracked as 1654175.
Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).
2023-01-11: Initial Publication