CVE-2022-22205: Junos OS: SRX Series: An FPC memory leak can occur in an APBR scenario
First published: Wed Jul 20 2022(Updated: )
A Missing Release of Memory after Effective Lifetime vulnerability in the Application Quality of Experience (appqoe) subsystem of the PFE of Juniper Networks Junos OS on SRX Series allows an unauthenticated network based attacker to cause a Denial of Service (DoS). Upon receiving specific traffic a memory leak will occur. Sustained processing of such specific traffic will eventually lead to an out of memory condition that prevents all services from continuing to function, and requires a manual restart to recover. A device is only vulnerable when advance(d) policy based routing (APBR) is configured and AppQoE (sla rule) is not configured for these APBR rules. This issue affects Juniper Networks Junos OS on SRX Series: 20.3 versions prior to 20.3R3-S2; 20.4 versions prior to 20.4R3-S2; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R2-S1, 21.2R3; 21.3 versions prior to 21.3R1-S2, 21.3R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.3R1.
Credit: sirt@juniper.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Juniper JUNOS | =20.3 | |
| Juniper JUNOS | =20.3-r1 | |
| Juniper JUNOS | =20.3-r1-s1 | |
| Juniper JUNOS | =20.3-r1-s2 | |
| Juniper JUNOS | =20.3-r2 | |
| Juniper JUNOS | =20.3-r2-s1 | |
| Juniper JUNOS | =20.3-r3 | |
| Juniper JUNOS | =20.3-r3-s1 | |
| Juniper JUNOS | =20.3-r3-s2 | |
| Juniper JUNOS | =20.4 | |
| Juniper JUNOS | =20.4-r1 | |
| Juniper JUNOS | =20.4-r1-s1 | |
| Juniper JUNOS | =20.4-r2 | |
| Juniper JUNOS | =20.4-r2-s1 | |
| Juniper JUNOS | =20.4-r2-s2 | |
| Juniper JUNOS | =20.4-r3 | |
| Juniper JUNOS | =20.4-r3-s1 | |
| Juniper JUNOS | =21.1 | |
| Juniper JUNOS | =21.1-r1 | |
| Juniper JUNOS | =21.1-r1-s1 | |
| Juniper JUNOS | =21.1-r2 | |
| Juniper JUNOS | =21.1-r2-s1 | |
| Juniper JUNOS | =21.1-r2-s2 | |
| Juniper JUNOS | =21.2 | |
| Juniper JUNOS | =21.2-r1 | |
| Juniper JUNOS | =21.2-r1-s1 | |
| Juniper JUNOS | =21.2-r1-s2 | |
| Juniper JUNOS | =21.2-r2 | |
| Juniper JUNOS | =21.3-r1 | |
| Juniper JUNOS | =21.3-r1-s1 | |
| Juniper Srx100 | ||
| Juniper Srx110 | ||
| Juniper Srx1400 | ||
| Juniper Srx1500 | ||
| Juniper Srx210 | ||
| Juniper Srx220 | ||
| Juniper Srx240 | ||
| Juniper Srx240h2 | ||
| Juniper Srx300 | ||
| Juniper Srx320 | ||
| Juniper Srx340 | ||
| Juniper Srx3400 | ||
| Juniper Srx345 | ||
| Juniper Srx3600 | ||
| Juniper Srx380 | ||
| Juniper Srx4000 | ||
| Juniper Srx4100 | ||
| Juniper Srx4200 | ||
| Juniper Srx4600 | ||
| Juniper Srx5000 | ||
| Juniper Srx5400 | ||
| Juniper Srx550 | ||
| Juniper Srx550 Hm | ||
| Juniper Srx550m | ||
| Juniper Srx5600 | ||
| Juniper Srx5800 | ||
| Juniper Srx650 |
Remedy
The following software releases have been updated to resolve this specific issue: 20.3R3-S2, 20.4R3-S2, 21.1R3, 21.2R2-S1, 21.2R3, 21.3R1-S2, 21.3R2, 21.4R1, and all subsequent releases.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-22205.
What is the severity of CVE-2022-22205?
The severity of CVE-2022-22205 is high, with a severity value of 7.5.
Which software is affected by CVE-2022-22205?
CVE-2022-22205 affects Juniper Networks Junos OS on SRX Series with versions 20.3 to 21.3.
How can CVE-2022-22205 be exploited?
CVE-2022-22205 can be exploited by an unauthenticated network-based attacker to cause a Denial of Service (DoS) by sending specific traffic.
Where can I find more information about CVE-2022-22205?
You can find more information about CVE-2022-22205 in the Juniper Networks Knowledge Base article at https://kb.juniper.net/JSA69709.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/author
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/references
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/juniper
- canonical/juniper junos
- version/juniper junos/20.3
- version/juniper junos/20.3-r1
- version/juniper junos/20.3-r1-s1
- version/juniper junos/20.3-r1-s2
- version/juniper junos/20.3-r2
- version/juniper junos/20.3-r2-s1
- version/juniper junos/20.3-r3
- version/juniper junos/20.3-r3-s1
- version/juniper junos/20.3-r3-s2
- version/juniper junos/20.4
- version/juniper junos/20.4-r1
- version/juniper junos/20.4-r1-s1
- version/juniper junos/20.4-r2
- version/juniper junos/20.4-r2-s1
- version/juniper junos/20.4-r2-s2
- version/juniper junos/20.4-r3
- version/juniper junos/20.4-r3-s1
- version/juniper junos/21.1
- version/juniper junos/21.1-r1
- version/juniper junos/21.1-r1-s1
- version/juniper junos/21.1-r2
- version/juniper junos/21.1-r2-s1
- version/juniper junos/21.1-r2-s2
- version/juniper junos/21.2
- version/juniper junos/21.2-r1
- version/juniper junos/21.2-r1-s1
- version/juniper junos/21.2-r1-s2
- version/juniper junos/21.2-r2
- version/juniper junos/21.3-r1
- version/juniper junos/21.3-r1-s1
- canonical/juniper srx100
- canonical/juniper srx110
- canonical/juniper srx1400
- canonical/juniper srx1500
- canonical/juniper srx210
- canonical/juniper srx220
- canonical/juniper srx240
- canonical/juniper srx240h2
- canonical/juniper srx300
- canonical/juniper srx320
- canonical/juniper srx340
- canonical/juniper srx3400
- canonical/juniper srx345
- canonical/juniper srx3600
- canonical/juniper srx380
- canonical/juniper srx4000
- canonical/juniper srx4100
- canonical/juniper srx4200
- canonical/juniper srx4600
- canonical/juniper srx5000
- canonical/juniper srx5400
- canonical/juniper srx550
- canonical/juniper srx550 hm
- canonical/juniper srx550m
- canonical/juniper srx5600
- canonical/juniper srx5800
- canonical/juniper srx650