5.9

CVE-2023-22402

Junos OS Evolved: The kernel might restart in a BGP scenario where "bgp auto-discovery" is enabled and such a neighbor flaps

A Use After Free vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). In a Non Stop Routing (NSR) scenario, an unexpected kernel restart might be observed if "bgp auto-discovery" is enabled and if there is a BGP neighbor flap of auto-discovery sessions for any reason. This is a race condition which is outside of an attackers direct control and it depends on system internal timing whether this issue occurs. This issue affects Juniper Networks Junos OS Evolved: 21.3 versions prior to 21.3R3-EVO; 21.4 versions prior to 21.4R2-EVO; 22.1 versions prior to 22.1R2-EVO; 22.2 versions prior to 22.2R1-S1-EVO, 22.2R2-EVO.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Juniper ≫ Junos Os Evolved Version 21.3 Update -
Juniper ≫ Junos Os Evolved Version 21.3 Update r1
Juniper ≫ Junos Os Evolved Version 21.3 Update r1-s1
Juniper ≫ Junos Os Evolved Version 21.3 Update r2
Juniper ≫ Junos Os Evolved Version 21.3 Update r2-s1
Juniper ≫ Junos Os Evolved Version 21.3 Update r2-s2
Juniper ≫ Junos Os Evolved Version 21.4 Update -
Juniper ≫ Junos Os Evolved Version 21.4 Update r1
Juniper ≫ Junos Os Evolved Version 21.4 Update r1-s1
Juniper ≫ Junos Os Evolved Version 21.4 Update r1-s2
Juniper ≫ Junos Os Evolved Version 22.1 Update r1
Juniper ≫ Junos Os Evolved Version 22.1 Update r1-s1
Juniper ≫ Junos Os Evolved Version 22.1 Update r1-s2
Juniper ≫ Junos Os Evolved Version 22.2 Update r1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.52% 0.4
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Juniper 5.9 2.2 3.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://kb.juniper.net/JSA70198
Vendor Advisory