CVE-2022-22228: Junos OS: IPv6 OAM SRv6 network-enabled devices are vulnerable to Denial of Service (DoS) due to RPD memory leak upon receipt of specific a IPv6 packet

Published Oct 18, 2022

Updated

An Improper Validation of Specified Type of Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS allows an attacker to cause an RPD memory leak leading to a Denial of Service (DoS). This memory leak only occurs when the attacker's packets are destined to any configured IPv6 address on the device. This issue affects: Juniper Networks Junos OS 21.1 versions prior to 21.1R3-S2; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2; 22.1 versions prior to 22.1R2. This issue does not affect Juniper Networks Junos OS versions prior to 21.1R1.

Affected Software

29 affected components

Juniper Junos=21.1

Juniper Junos=21.1-r1

Juniper Junos=21.1-r1-s1

Juniper Junos=21.1-r2

Juniper Junos=21.1-r2-s1

Juniper Junos=21.1-r2-s2

Juniper Junos=21.1-r3

Juniper Junos=21.1-r3-s1

Juniper Junos=21.2

Juniper Junos=21.2-r1

Juniper Junos=21.2-r1-s1

Juniper Junos=21.2-r1-s2

Juniper Junos=21.2-r2

Juniper Junos=21.2-r2-s1

Juniper Junos=21.2-r2-s2

Juniper Junos=21.2-r3

Juniper Junos=21.3

Juniper Junos=21.3-r1

Juniper Junos=21.3-r1-s1

Juniper Junos=21.3-r1-s2

Juniper Junos=21.3-r2

Juniper Junos=21.3-r2-s1

Juniper Junos=21.3-r2-s2

Juniper Junos=21.4

Juniper Junos=21.4-r1

Juniper Junos=21.4-r1-s1

Juniper Junos=21.4-r1-s2

Juniper Junos=22.1-r1

Juniper Junos=22.1-r1-s1

Remediation

Information

The following software releases have been updated to resolve this specific issue: Junos OS: 21.1R3-S2, 21.2R3-S1, 21.3R3, 21.4R2, 22.1R2, 22.2R1, and all subsequent releases.

Event History

Oct 18, 2022

CVE Published

via MITRE·02:46 AM

Data Sourced

via MITRE·02:46 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-22228?

CVE-2022-22228 has a critical severity level due to its potential to cause a Denial of Service by leaking memory.

How do I fix CVE-2022-22228?

To fix CVE-2022-22228, you should upgrade to the patched versions of Junos OS as specified in the vendor's advisory.

What systems are affected by CVE-2022-22228?

CVE-2022-22228 affects specific versions of Junos OS, including 21.1, 21.2, 21.3, and 21.4.

Can CVE-2022-22228 be exploited remotely?

Yes, CVE-2022-22228 can be exploited remotely if an attacker sends specially crafted packets to the affected system.

What happens if CVE-2022-22228 is successfully exploited?

If CVE-2022-22228 is successfully exploited, it may lead to a memory leak that causes the routing protocol daemon to crash, resulting in a Denial of Service.