CVE-2022-22213: Junos OS and Junos OS Evolved: Denial of Service (DoS) vulnerability in RPD upon receipt of specific BGP update
First published: Wed Jul 20 2022(Updated: )
A vulnerability in Handling of Undefined Values in the routing protocol daemon (RPD) process of Juniper Networks Junos OS and Junos OS Evolved may allow an unauthenticated network-based attacker to crash the RPD process by sending a specific BGP update while the system is under heavy load, leading to a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. Malicious exploitation of this issue requires a very specific combination of load, timing, and configuration of the vulnerable system which is beyond the direct control of the attacker. Internal reproduction has only been possible through artificially created load and specially instrumented source code. Systems are only vulnerable to this issue if BGP multipath is enabled. Routers not configured for BGP multipath are not vulnerable to this issue. This issue affects: Juniper Networks Junos OS: 21.1 versions prior to 21.1R3-S1; 21.2 versions prior to 21.2R2-S2, 21.2R3; 21.3 versions prior to 21.3R2, 21.3R3; 21.4 versions prior to 21.4R1-S1, 21.4R2. Juniper Networks Junos OS Evolved: 21.1 versions prior to 21.1R3-S1-EVO; 21.2 version 21.2R1-EVO and later versions; 21.3 versions prior to 21.3R3-EVO; 21.4 versions prior to 21.4R1-S1-EVO, 21.4R2-EVO. This issue does not affect: Juniper Networks Junos OS versions prior to 21.1. Juniper Networks Junos OS Evolved versions prior to 21.1-EVO.
Credit: sirt@juniper.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Junos OS Evolved | =21.1 | |
| Junos OS Evolved | =21.1-r1 | |
| Junos OS Evolved | =21.1-r1-s1 | |
| Junos OS Evolved | =21.1-r2 | |
| Junos OS Evolved | =21.1-r2-s1 | |
| Junos OS Evolved | =21.1-r2-s2 | |
| Junos OS Evolved | =21.1-r3 | |
| Junos OS Evolved | =21.2 | |
| Junos OS Evolved | =21.2-r1 | |
| Junos OS Evolved | =21.2-r1-s1 | |
| Junos OS Evolved | =21.2-r1-s2 | |
| Junos OS Evolved | =21.2-r2 | |
| Junos OS Evolved | =21.2-r2-s1 | |
| Junos OS Evolved | =21.2-r2-s2 | |
| Junos OS Evolved | =21.3 | |
| Junos OS Evolved | =21.3-r1 | |
| Junos OS Evolved | =21.3-r1-s1 | |
| Junos OS Evolved | =21.3-r1-s2 | |
| Junos OS Evolved | =21.3-r2 | |
| Junos OS Evolved | =21.4 | |
| Junos OS Evolved | =21.4-r1 | |
| Junos OS Evolved | =21.4-r1-s1 | |
| Juniper JUNOS | =21.1 | |
| Juniper JUNOS | =21.1-r1 | |
| Juniper JUNOS | =21.1-r1-s1 | |
| Juniper JUNOS | =21.1-r2 | |
| Juniper JUNOS | =21.1-r3 | |
| Juniper JUNOS | =21.2 | |
| Juniper JUNOS | =21.2-r1 | |
| Juniper JUNOS | =21.2-r1-s1 | |
| Juniper JUNOS | =21.2-r1-s2 | |
| Juniper JUNOS | =21.2-r2 | |
| Juniper JUNOS | =21.2-r2-s1 | |
| Juniper JUNOS | =21.2-r2-s2 | |
| Juniper JUNOS | =21.2-r3 | |
| Juniper JUNOS | =21.3 | |
| Juniper JUNOS | =21.3-r1 | |
| Juniper JUNOS | =21.3-r1-s1 | |
| Juniper JUNOS | =21.3-r2 | |
| Juniper JUNOS | =21.4 | |
| Juniper JUNOS | =21.4-r1 |
Remedy
The following software releases have been updated to resolve this specific issue: Junos OS Evolved: 21.1R3-S1-EVO, 21.3R3-EVO, 21.4R1-S1-EVO, 21.4R2-EVO, 22.1R1-EVO Junos OS: 21.1R3-S1, 21.2R2-S2, 21.2R3, 21.3R2, 21.4R1-S1, 21.4R2, 22.1R1, and all subsequent releases.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-22213?
CVE-2022-22213 is rated as critical due to its potential to allow unauthenticated attackers to crash the routing protocol daemon.
How do I fix CVE-2022-22213?
The recommended fix for CVE-2022-22213 is to update to the latest version of Junos OS that addresses this vulnerability.
What systems are affected by CVE-2022-22213?
CVE-2022-22213 affects Junos OS versions 21.1, 21.2, 21.3, and 21.4 across various releases.
What does CVE-2022-22213 exploit?
CVE-2022-22213 exploits the handling of undefined values in the routing protocol daemon, particularly through specific BGP updates.
Can CVE-2022-22213 be exploited remotely?
Yes, CVE-2022-22213 can be exploited by unauthenticated network-based attackers, making it a serious concern for exposed systems.
- agent/type
- agent/severity
- agent/author
- agent/weakness
- agent/title
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/remedy
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/juniper
- canonical/junos os evolved
- version/junos os evolved/21.1
- version/junos os evolved/21.1-r1
- version/junos os evolved/21.1-r1-s1
- version/junos os evolved/21.1-r2
- version/junos os evolved/21.1-r2-s1
- version/junos os evolved/21.1-r2-s2
- version/junos os evolved/21.1-r3
- version/junos os evolved/21.2
- version/junos os evolved/21.2-r1
- version/junos os evolved/21.2-r1-s1
- version/junos os evolved/21.2-r1-s2
- version/junos os evolved/21.2-r2
- version/junos os evolved/21.2-r2-s1
- version/junos os evolved/21.2-r2-s2
- version/junos os evolved/21.3
- version/junos os evolved/21.3-r1
- version/junos os evolved/21.3-r1-s1
- version/junos os evolved/21.3-r1-s2
- version/junos os evolved/21.3-r2
- version/junos os evolved/21.4
- version/junos os evolved/21.4-r1
- version/junos os evolved/21.4-r1-s1
- canonical/juniper junos
- version/juniper junos/21.1
- version/juniper junos/21.1-r1
- version/juniper junos/21.1-r1-s1
- version/juniper junos/21.1-r2
- version/juniper junos/21.1-r3
- version/juniper junos/21.2
- version/juniper junos/21.2-r1
- version/juniper junos/21.2-r1-s1
- version/juniper junos/21.2-r1-s2
- version/juniper junos/21.2-r2
- version/juniper junos/21.2-r2-s1
- version/juniper junos/21.2-r2-s2
- version/juniper junos/21.2-r3
- version/juniper junos/21.3
- version/juniper junos/21.3-r1
- version/juniper junos/21.3-r1-s1
- version/juniper junos/21.3-r2
- version/juniper junos/21.4
- version/juniper junos/21.4-r1