CVE-2023-22402: Junos OS Evolved: The kernel might restart in a BGP scenario where "bgp auto-discovery" is enabled and such a neighbor flaps
A Use After Free vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). In a Non Stop Routing (NSR) scenario, an unexpected kernel restart might be observed if "bgp auto-discovery" is enabled and if there is a BGP neighbor flap of auto-discovery sessions for any reason. This is a race condition which is outside of an attackers direct control and it depends on system internal timing whether this issue occurs. This issue affects Juniper Networks Junos OS Evolved: 21.3 versions prior to 21.3R3-EVO; 21.4 versions prior to 21.4R2-EVO; 22.1 versions prior to 22.1R2-EVO; 22.2 versions prior to 22.2R1-S1-EVO, 22.2R2-EVO.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this Juniper Networks Junos OS Evolved vulnerability?
The vulnerability ID is CVE-2023-22402.
What is the severity of CVE-2023-22402?
The severity of CVE-2023-22402 is medium with a severity value of 5.9.
How does CVE-2023-22402 affect Juniper Junos OS Evolved?
CVE-2023-22402 allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS) in Juniper Junos OS Evolved.
Is there a fix available for CVE-2023-22402?
Yes, a fix is available for CVE-2023-22402. Please refer to the Juniper Networks advisory for more information.
Where can I find more information about CVE-2023-22402?
More information about CVE-2023-22402 can be found in the Juniper Networks knowledge base article: https://kb.juniper.net/JSA70198