CVE-2023-22398: Junos OS and Junos OS Evolved: RPD might crash when MPLS ping is performed on BGP LSPs

Published Jan 12, 2023

Updated

An Access of Uninitialized Pointer vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a locally authenticated attacker with low privileges to cause a Denial of Service (DoS). When an MPLS ping is performed on BGP LSPs, the RPD might crash. Repeated execution of this operation will lead to a sustained DoS. This issue affects: Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S12; 19.1 versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R1-S9, 19.2R3-S5; 19.3 versions prior to 19.3R3-S6; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S4; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R1-S1, 21.1R2; Juniper Networks Junos OS Evolved: All versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R2-EVO.

Affected Software

193 affected components

Juniper JUNOS=15.1

Juniper JUNOS=15.1-a1

Juniper JUNOS=15.1-f1

Juniper JUNOS=15.1-f2

Juniper JUNOS=15.1-f2-s1

Juniper JUNOS=15.1-f2-s2

Juniper JUNOS=15.1-f2-s3

Juniper JUNOS=15.1-f2-s4

Juniper JUNOS=15.1-f3

Juniper JUNOS=15.1-f4

Juniper JUNOS=15.1-f5

Juniper JUNOS=15.1-f5-s7

Juniper JUNOS=15.1-f6

Juniper JUNOS=15.1-f6-s1

Juniper JUNOS=15.1-f6-s10

Juniper JUNOS=15.1-f6-s12

Juniper JUNOS=15.1-f6-s2

Juniper JUNOS=15.1-f6-s3

Juniper JUNOS=15.1-f6-s4

Juniper JUNOS=15.1-f6-s5

Juniper JUNOS=15.1-f6-s6

Juniper JUNOS=15.1-f6-s7

Juniper JUNOS=15.1-f6-s8

Juniper JUNOS=15.1-f6-s9

Juniper JUNOS=15.1-f7

Juniper JUNOS=15.1-r1

Juniper JUNOS=15.1-r2

Juniper JUNOS=15.1-r3

Juniper JUNOS=15.1-r4

Juniper JUNOS=15.1-r4-s7

Juniper JUNOS=15.1-r4-s8

Juniper JUNOS=15.1-r4-s9

Juniper JUNOS=15.1-r5

Juniper JUNOS=15.1-r5-s1

Juniper JUNOS=15.1-r5-s3

Juniper JUNOS=15.1-r5-s5

Juniper JUNOS=15.1-r5-s6

Juniper JUNOS=15.1-r6

Juniper JUNOS=15.1-r6-s1

Juniper JUNOS=15.1-r6-s2

Juniper JUNOS=15.1-r6-s3

Juniper JUNOS=15.1-r6-s4

Juniper JUNOS=15.1-r6-s6

Juniper JUNOS=15.1-r7

Juniper JUNOS=15.1-r7-s1

Juniper JUNOS=15.1-r7-s10

Juniper JUNOS=15.1-r7-s11

Juniper JUNOS=15.1-r7-s2

Juniper JUNOS=15.1-r7-s3

Juniper JUNOS=15.1-r7-s4

Juniper JUNOS=15.1-r7-s5

Juniper JUNOS=15.1-r7-s6

Juniper JUNOS=15.1-r7-s7

Juniper JUNOS=15.1-r7-s8

Juniper JUNOS=15.1-r7-s9

Juniper JUNOS=19.1

Juniper JUNOS=19.1-r1

Juniper JUNOS=19.1-r1-s1

Juniper JUNOS=19.1-r1-s2

Juniper JUNOS=19.1-r1-s3

Juniper JUNOS=19.1-r1-s4

Juniper JUNOS=19.1-r1-s5

Juniper JUNOS=19.1-r1-s6

Juniper JUNOS=19.1-r2

Juniper JUNOS=19.1-r2-s1

Juniper JUNOS=19.1-r2-s2

Juniper JUNOS=19.1-r2-s3

Juniper JUNOS=19.1-r3

Juniper JUNOS=19.1-r3-s1

Juniper JUNOS=19.1-r3-s2

Juniper JUNOS=19.1-r3-s3

Juniper JUNOS=19.1-r3-s4

Juniper JUNOS=19.1-r3-s5

Juniper JUNOS=19.1-r3-s6

Juniper JUNOS=19.1-r3-s7

Juniper JUNOS=19.1-r3-s8

Juniper JUNOS=19.2

Juniper JUNOS=19.2-r1

Juniper JUNOS=19.2-r1-s1

Juniper JUNOS=19.2-r1-s2

Juniper JUNOS=19.2-r1-s3

Juniper JUNOS=19.2-r1-s4

Juniper JUNOS=19.2-r1-s5

Juniper JUNOS=19.2-r1-s6

Juniper JUNOS=19.2-r1-s7

Juniper JUNOS=19.2-r1-s8

Juniper JUNOS=19.2-r3

Juniper JUNOS=19.2-r3-s1

Juniper JUNOS=19.2-r3-s2

Juniper JUNOS=19.2-r3-s3

Juniper JUNOS=19.2-r3-s4

Juniper JUNOS=19.3

Juniper JUNOS=19.3-r1

Juniper JUNOS=19.3-r1-s1

Juniper JUNOS=19.3-r2

Juniper JUNOS=19.3-r2-s1

Juniper JUNOS=19.3-r2-s2

Juniper JUNOS=19.3-r2-s3

Juniper JUNOS=19.3-r2-s4

Juniper JUNOS=19.3-r2-s5

Juniper JUNOS=19.3-r2-s6

Juniper JUNOS=19.3-r3

Juniper JUNOS=19.3-r3-s1

Juniper JUNOS=19.3-r3-s2

Juniper JUNOS=19.3-r3-s3

Juniper JUNOS=19.3-r3-s4

Juniper JUNOS=19.3-r3-s5

Juniper JUNOS=19.4

Juniper JUNOS=19.4-r1

Juniper JUNOS=19.4-r1-s1

Juniper JUNOS=19.4-r1-s2

Juniper JUNOS=19.4-r1-s3

Juniper JUNOS=19.4-r1-s4

Juniper JUNOS=19.4-r2

Juniper JUNOS=19.4-r2-s1

Juniper JUNOS=19.4-r2-s2

Juniper JUNOS=19.4-r2-s3

Juniper JUNOS=19.4-r2-s4

Juniper JUNOS=19.4-r2-s5

Juniper JUNOS=19.4-r2-s6

Juniper JUNOS=19.4-r3

Juniper JUNOS=19.4-r3-s1

Juniper JUNOS=19.4-r3-s2

Juniper JUNOS=19.4-r3-s3

Juniper JUNOS=19.4-r3-s4

Juniper JUNOS=19.4-r3-s5

Juniper JUNOS=19.4-r3-s6

Juniper JUNOS=19.4-r3-s7

Juniper JUNOS=20.1

Juniper JUNOS=20.1-r1

Juniper JUNOS=20.1-r1-s1

Juniper JUNOS=20.1-r1-s2

Juniper JUNOS=20.1-r1-s3

Juniper JUNOS=20.1-r1-s4

Juniper JUNOS=20.1-r2

Juniper JUNOS=20.1-r2-s1

Juniper JUNOS=20.1-r2-s2

Juniper JUNOS=20.1-r3

Juniper JUNOS=20.1-r3-s1

Juniper JUNOS=20.1-r3-s2

Juniper JUNOS=20.1-r3-s3

Juniper JUNOS=20.2

Juniper JUNOS=20.2-r1

Juniper JUNOS=20.2-r1-s1

Juniper JUNOS=20.2-r1-s2

Juniper JUNOS=20.2-r1-s3

Juniper JUNOS=20.2-r2

Juniper JUNOS=20.2-r2-s1

Juniper JUNOS=20.2-r2-s2

Juniper JUNOS=20.2-r2-s3

Juniper JUNOS=20.2-r3

Juniper JUNOS=20.2-r3-s1

Juniper JUNOS=20.2-r3-s2

Juniper JUNOS=20.2-r3-s3

Juniper JUNOS=20.2-r3-s4

Juniper JUNOS=20.3

Juniper JUNOS=20.3-r1

Juniper JUNOS=20.3-r1-s1

Juniper JUNOS=20.3-r1-s2

Juniper JUNOS=20.3-r2

Juniper JUNOS=20.3-r2-s1

Juniper JUNOS=20.3-r3

Juniper JUNOS=20.3-r3-s1

Juniper JUNOS=20.3-r3-s2

Juniper JUNOS=20.3-r3-s3

Juniper JUNOS=20.3-r3-s4

Juniper JUNOS=20.4

Juniper JUNOS=20.4-r1

Juniper JUNOS=20.4-r1-s1

Juniper JUNOS=20.4-r2

Juniper JUNOS=20.4-r2-s1

Juniper JUNOS=20.4-r2-s2

Juniper JUNOS=20.4-r3

Juniper JUNOS=20.4-r3-s1

Juniper JUNOS=20.4-r3-s2

Juniper JUNOS=20.4-r3-s3

Juniper JUNOS=21.1

Juniper JUNOS=21.1-r1

Juniper Junos OS Evolved=20.4

Juniper Junos OS Evolved=20.4-r1

Juniper Junos OS Evolved=20.4-r1-s1

Juniper Junos OS Evolved=20.4-r1-s2

Juniper Junos OS Evolved=20.4-r2

Juniper Junos OS Evolved=20.4-r2-s1

Juniper Junos OS Evolved=20.4-r2-s2

Juniper Junos OS Evolved=20.4-r2-s3

Juniper Junos OS Evolved=20.4-r3

Juniper Junos OS Evolved=20.4-r3-s1

Juniper Junos OS Evolved=20.4-r3-s2

Juniper Junos OS Evolved=20.4-r3-s3

Juniper Junos OS Evolved=21.1

Juniper Junos OS Evolved=21.1-r1

Juniper Junos OS Evolved=21.1-r1-s1

Remediation

Information

The following software releases have been updated to resolve this specific issue: Junos OS: 15.1R7-S12, 19.1R3-S9, 19.2R1-S9, 19.2R3-S5, 19.3R3-S6, 19.4R2-S7, 19.4R3-S8, 20.1R3-S4, 20.2R3-S5, 20.3R3-S5, 20.4R3-S4, 21.1R1-S1, 21.1R2, 21.2R1, and all subsequent releases. Junos OS Evolved: 20.4R3-S4-EVO, 21.1R2-EVO, 21.2R1-EVO and all subsequent releases.

Event History

Jan 12, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-22398?

CVE-2023-22398 has a severity rating that indicates it allows a locally authenticated attacker to cause a Denial of Service (DoS).

How do I fix CVE-2023-22398?

To fix CVE-2023-22398, ensure that you update your Junos OS to the latest version available that addresses this vulnerability.

What versions of Junos OS are affected by CVE-2023-22398?

CVE-2023-22398 affects multiple versions of Junos OS including 15.1, 19.1, 19.2, 19.3, 19.4, 20.1, 20.2, 20.3, and 20.4.

Can CVE-2023-22398 be exploited remotely?

CVE-2023-22398 requires local authentication, so it cannot be exploited remotely without local access.

What type of vulnerability is CVE-2023-22398?

CVE-2023-22398 is classified as an Access of Uninitialized Pointer vulnerability.