Lucene search

[email protected]CVE-2023-22402

HistoryJan 13, 2023 - 12:15 a.m.

CVE-2023-22402

2023-01-1300:15:10

CWE-416

[email protected]

web.nvd.nist.gov

166

cve

2023

22402

use after free

vulnerability

juniper networks

junos os

evolved

kernel

dos

nvd

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

37.0%

JSON

A Use After Free vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). In a Non Stop Routing (NSR) scenario, an unexpected kernel restart might be observed if “bgp auto-discovery” is enabled and if there is a BGP neighbor flap of auto-discovery sessions for any reason. This is a race condition which is outside of an attackers direct control and it depends on system internal timing whether this issue occurs. This issue affects Juniper Networks Junos OS Evolved: 21.3 versions prior to 21.3R3-EVO; 21.4 versions prior to 21.4R2-EVO; 22.1 versions prior to 22.1R2-EVO; 22.2 versions prior to 22.2R1-S1-EVO, 22.2R2-EVO.

Affected configurations

NVD

Node

juniperjunos_os_evolvedMatch21.3-

juniperjunos_os_evolvedMatch21.3r1

juniperjunos_os_evolvedMatch21.3r1-s1

juniperjunos_os_evolvedMatch21.3r2

juniperjunos_os_evolvedMatch21.3r2-s1

juniperjunos_os_evolvedMatch21.3r2-s2

juniperjunos_os_evolvedMatch21.4-

juniperjunos_os_evolvedMatch21.4r1

juniperjunos_os_evolvedMatch21.4r1-s1

juniperjunos_os_evolvedMatch21.4r1-s2

juniperjunos_os_evolvedMatch22.1r1

juniperjunos_os_evolvedMatch22.1r1-s1

juniperjunos_os_evolvedMatch22.1r1-s2

juniperjunos_os_evolvedMatch22.2r1

CPENameOperatorVersion
juniper:junos_os_evolvedjuniper junos os evolvedeq21.3
juniper:junos_os_evolvedjuniper junos os evolvedeq21.4
juniper:junos_os_evolvedjuniper junos os evolvedeq22.1
juniper:junos_os_evolvedjuniper junos os evolvedeq22.2

CPE	Name	Operator	Version
juniper:junos_os_evolved	juniper junos os evolved	eq	21.3
juniper:junos_os_evolved	juniper junos os evolved	eq	21.4
juniper:junos_os_evolved	juniper junos os evolved	eq	22.1
juniper:junos_os_evolved	juniper junos os evolved	eq	22.2

CNA Affected

[
  {
    "vendor": "Juniper Networks",
    "product": "Junos OS Evolved",
    "versions": [
      {
        "version": "21.3",
        "status": "affected",
        "lessThan": "21.3R3-EVO",
        "versionType": "custom"
      },
      {
        "version": "21.4",
        "status": "affected",
        "lessThan": "21.4R2-EVO",
        "versionType": "custom"
      },
      {
        "version": "22.1",
        "status": "affected",
        "lessThan": "22.1R2-EVO",
        "versionType": "custom"
      },
      {
        "version": "22.2",
        "status": "affected",
        "lessThan": "22.2R1-S1-EVO, 22.2R2-EVO",
        "versionType": "custom"
      }
    ]
  }
]