Juniper Junos OS up to 21.2 Advanced Forwarding Toolkit use after free

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Juniper Junos OS up to 21.2. Affected by this vulnerability is an unknown functionality of the component Advanced Forwarding Toolkit. The manipulation leads to use after free. This vulnerability is documented as CVE-2022-22207. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Juniper Junos OS up to 21.2 (Router Operating System) and classified as critical. This issue affects an unknown functionality of the component Advanced Forwarding Toolkit. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is availability. The summary by CVE is:

A Use After Free vulnerability in the Advanced Forwarding Toolkit (AFT) manager process (aftmand) of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause a kernel crash due to intensive polling of Abstracted Fabric (AF) interface statistics and thereby a Denial of Service (DoS). Continued gathering of AF interface statistics will create a sustained Denial of Service (DoS) condition. This issue affects Juniper Networks Junos OS on MX Series: 20.1 versions later than 20.1R1; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S4; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2; 21.2 versions prior to 21.2R2.

The weakness was released 07/20/2022 as JSA69711. It is possible to read the advisory at kb.juniper.net. The identification of this vulnerability is CVE-2022-22207 since 12/21/2021. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/20/2022).

Upgrading to version 20.1R1, 20.2R3-S5, 20.3R3-S4, 20.4R3, 21.1R2 or 21.2R2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

Version

• 20.0
• 20.2R3-S3
• 20.3R3-S2
• 20.4R1
• 21.0
• 21.1
• 21.2

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion