Juniper Junos OS Packet Forwarding Engine improper preservation of consistency between independent representations of shared state

Summaryinfo

A vulnerability categorized as critical has been discovered in Juniper Junos OS. This affects an unknown function of the component Packet Forwarding Engine. The manipulation results in improper preservation of consistency between independent representations of shared state. This vulnerability is identified as CVE-2023-22405. The attack can only be performed from the local network. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Juniper Junos OS (Router Operating System) (affected version unknown). Affected is an unknown functionality of the component Packet Forwarding Engine. The manipulation with an unknown input leads to a improper preservation of consistency between independent representations of shared state vulnerability. CWE is classifying the issue as CWE-1250. The product has or supports multiple distributed components or sub-systems that are each required to keep their own local copy of shared data - such as state or cache - but the product does not ensure that all local copies remain consistent with each other. This is going to have an impact on availability. CVE summarizes:

An Improper Preservation of Consistency Between Independent Representations of Shared State vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS) to device due to out of resources. When a device is configured with "service-provider/SP style" switching, and mac-limiting is configured on an Aggregated Ethernet (ae) interface, and then a PFE is restarted or the device is rebooted, mac-limiting doesn't work anymore. Please note that the issue might not be apparent as traffic will continue to flow through the device although the mac table and respective logs will indicate that mac limit is reached. Functionality can be restored by removing and re-adding the MAC limit configuration. This issue affects Juniper Networks Junos OS on QFX5k Series, EX46xx Series: All versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S3; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3 on; 21.4 versions prior to 21.4R3 on; 22.1 versions prior to 22.1R2 on.

The weakness was released 01/13/2023 as JSA70201. The advisory is available at kb.juniper.net. This vulnerability is traded as CVE-2023-22405 since 12/27/2022. The technical details are unknown and an exploit is not available.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-26568). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion