CVE-2022-22188 : An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer O

An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer Overflow in the packet forwarding engine (PFE) of Juniper Networks Junos OS allows a network-based unauthenticated attacker to flood the device with traffic leading to a Denial of Service (DoS). The device must be configured with storm control profiling limiting the number of unknown broadcast, multicast, or unicast traffic to be vulnerable to this issue. This issue affects: Juniper Networks Junos OS on QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series; 20.2 version 20.2R1 and later versions prior to 20.2R2. This issue does not affect: Juniper Networks Junos OS versions prior to 20.2R1.

Published 2022-04-14 16:15:08

Updated 2022-04-21 09:44:01

Source Juniper Networks, Inc.

View at NVD, CVE.org

Vulnerability category: OverflowDenial of service

Products affected by CVE-2022-22188

Juniper » Junos » Version: 20.2 Update R1
cpe:2.3:o:juniper:junos:20.2:r1:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Ex4650 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5110 » Version: N/A
When used together with: Juniper » Qfx5120 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
When used together with: Juniper » Qfx5210 » Version: N/A
Juniper » Junos » Version: 20.2 Update R1-s1
cpe:2.3:o:juniper:junos:20.2:r1-s1:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Ex4650 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5110 » Version: N/A
When used together with: Juniper » Qfx5120 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
When used together with: Juniper » Qfx5210 » Version: N/A
Juniper » Junos » Version: 20.2 Update R1-s2
cpe:2.3:o:juniper:junos:20.2:r1-s2:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Ex4650 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5110 » Version: N/A
When used together with: Juniper » Qfx5120 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
When used together with: Juniper » Qfx5210 » Version: N/A
Juniper » Junos » Version: 20.2 Update R1-s3
cpe:2.3:o:juniper:junos:20.2:r1-s3:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Ex4650 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5110 » Version: N/A
When used together with: Juniper » Qfx5120 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
When used together with: Juniper » Qfx5210 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-22188

EPSS FAQ

0.13%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 47 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-22188

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:N/A:P	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	Juniper Networks, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2022-22188

CWE-122 Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Assigned by: sirt@juniper.net (Primary)
CWE-789 Memory Allocation with Excessive Size Value

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Assigned by: sirt@juniper.net (Primary)

References for CVE-2022-22188

https://kb.juniper.net/JSA69497

Article Detail
Exploit;Vendor Advisory

Jump to

Vulnerability Details : CVE-2022-22188

Products affected by CVE-2022-22188

Exploit prediction scoring system (EPSS) score for CVE-2022-22188

CVSS scores for CVE-2022-22188

CWE ids for CVE-2022-22188

References for CVE-2022-22188