CVE-2022-22211

{"id": "CVE-2022-22211", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "sirt@juniper.net", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-10-18T03:15:09.413", "references": [{"url": "https://kb.juniper.net/JSA69916", "tags": ["Permissions Required"], "source": "sirt@juniper.net"}, {"url": "https://kb.juniper.net/JSA69916", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "sirt@juniper.net", "description": [{"lang": "en", "value": "CWE-770"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "A limitless resource allocation vulnerability in FPC resources of Juniper Networks Junos OS Evolved on PTX Series allows an unprivileged attacker to cause Denial of Service (DoS). Continuously polling the SNMP jnxCosQstatTable causes the FPC to run out of GUID space, causing a Denial of Service to the FPC resources. When the FPC runs out of the GUID space, you will see the following syslog messages. The evo-aftmand-bt process is asserting. fpc1 evo-aftmand-bt[17556]: %USER-3: get_next_guid: Ran out of Guid Space start 1748051689472 end 1752346656767 fpc1 audit[17556]: %AUTH-5: ANOM_ABEND auid=4294967295 uid=0 gid=0 ses=4294967295 pid=17556 comm=\"EvoAftManBt-mai\" exe=\"/usr/sbin/evo-aftmand-bt\" sig=6 fpc1 kernel: %KERN-5: audit: type=1701 audit(1648567505.119:57): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=17556 comm=\"EvoAftManBt-mai\" exe=\"/usr/sbin/evo-aftmand-bt\" sig=6 fpc1 emfd-fpa[14438]: %USER-5: Alarm set: APP color=red, class=CHASSIS, reason=Application evo-aftmand-bt fail on node Fpc1 fpc1 emfd-fpa[14438]: %USER-3-EMF_FPA_ALARM_REP: RaiseAlarm: Alarm(Location: /Chassis[0]/Fpc[1] Module: sysman Object: evo-aftmand-bt:0 Error: 2) reported fpc1 sysepochman[12738]: %USER-5-SYSTEM_REBOOT_EVENT: Reboot [node] [ungraceful reboot] [evo-aftmand-bt exited] The FPC resources can be monitored using the following commands: user@router> start shell [vrf:none] user@router-re0:~$ cli -c \"show platform application-info allocations app evo-aftmand-bt\" | grep ^fpc | grep -v Route | grep -i -v Nexthop | awk '{total[$1] += $5} END { for (key in total) { print key \" \" total[key]/4294967296 }}' Once the FPCs become unreachable they must be manually restarted as they do not self-recover. This issue affects Juniper Networks Junos OS Evolved on PTX Series: All versions prior to 20.4R3-S4-EVO; 21.1-EVO version 21.1R1-EVO and later versions; 21.2-EVO version 21.2R1-EVO and later versions; 21.3-EVO versions prior to 21.3R3-EVO; 21.4-EVO versions prior to 21.4R2-EVO; 22.1-EVO versions prior to 22.1R2-EVO."}, {"lang": "es", "value": "Una vulnerabilidad de asignaci\u00f3n de recursos ilimitada en los recursos FPC de Juniper Networks Junos OS Evolved on PTX Series permite a un atacante no privilegiado causar una Denegaci\u00f3n de Servicio (DoS). El sondeo continuo de la tabla SNMP jnxCosQstatTable causa que el FPC se quede sin espacio GUID, causando una Denegaci\u00f3n de Servicio a los recursos del FPC. Cuando el FPC quede sin espacio GUID, visualizar\u00e1 los siguientes mensajes syslog. El proceso evo-aftmand-bt est\u00e1 afirmando. fpc1 evo-aftmand-bt[17556]: %USER-3: get_next_guid: Ran out of Guid Space start 1748051689472 end 1752346656767 fpc1 audit[17556]: %AUTH-5: ANOM_ABEND auid=4294967295 uid=0 gid=0 ses=4294967295 pid=17556 comm=\"EvoAftManBt-mai\" exe=\"/usr/sbin/evo-aftmand-bt\" sig=6 fpc1 kernel: %KERN-5: audit: type=1701 audit(1648567505. 119:57): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=17556 comm=\"EvoAftManBt-mai\" exe=\"/usr/sbin/evo-aftmand-bt\" sig=6 fpc1 emfd-fpa[14438]: %USER-5: Alarm set: APP color=red, class=CHASSIS, reason=La aplicaci\u00f3n evo-aftmand-bt falla en el nodo Fpc1 fpc1 emfd-fpa[14438]: %USER-3-EMF_FPA_ALARM_REP: RaiseAlarm: Alarm(Location: /Chassis[0]/Fpc[1] M\u00f3dulo: sysman Objeto: evo-aftmand-bt:0 Error: 2) reportado fpc1 sysepochman[12738]: %USER-5-SYSTEM_REBOOT_EVENT: Reboot [node] [ungraceful reboot] [evo-aftmand-bt exited] Los recursos del FPC pueden ser monitoreados usando los siguientes comandos: user@router) start shell [vrf:none] user@router-re0:~$ cli -c \"show platform application-info allocations app evo-aftmand-bt\" | grep ^fpc | grep -v Route | grep -i -v Nexthop | awk \"{total[$1] += $5} END { for (key in total) { print key \" \" total[key]/4294967296 }}\" Una vez que las FPC son vueltas inalcanzables, deben reiniciarse manualmente, ya que no son autorrecuperadas. Este problema afecta a Juniper Networks Junos OS Evolved on PTX Series: Todas las versiones anteriores a 20.4R3-S4-EVO; 21.1-EVO versi\u00f3n 21.1R1-EVO y versiones posteriores; 21.2-EVO versi\u00f3n 21.2R1-EVO y versiones posteriores; 21.3-EVO versiones anteriores a 21.3R3-EVO; 21.4-EVO versiones anteriores a 21.4R2-EVO; 22.1-EVO versiones anteriores a 22.1R2-EVO"}], "lastModified": "2024-11-21T06:46:24.087", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F41A7DF-2B27-4E2E-ABFC-E0510A028199", "versionEndExcluding": "20.4"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:20.4:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "247FB9DF-7EC0-4298-B27C-3235D141C1D6"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:20.4:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9C8866D-162F-4C9B-8167-2FBA25410368"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:20.4:r1-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F85E5BC7-8607-4330-AA72-2273D32F8604"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:20.4:r1-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "878C81C9-A418-4A21-8FDB-2116A992679C"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:20.4:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7451A671-A3CC-4904-8D45-947B1D3783C9"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:20.4:r2-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0108AD20-EAE6-41D1-AE48-254C46B5388A"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:20.4:r2-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44FBCA6F-EB05-4EE4-85FD-944BDAF7D81B"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:20.4:r2-s3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E554FD12-FE69-44D1-B2C9-4382F8CA4456"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:20.4:r3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0C1D53E-70BE-4246-89ED-1074C8C70747"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:20.4:r3-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B39DDCF8-BB68-49F4-8AAF-AE25C9C13AC1"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:20.4:r3-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B38A90A9-B739-49BE-8845-9ABF846CCC5D"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:20.4:r3-s3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AAE56A7C-BA26-405F-A640-C43AF78B0A3B"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "52C3552E-798F-4719-B38D-F74E34EAAA40"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.1:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE674DD3-3590-4434-B144-5AD7EB5F039D"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.1:r1-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0099BDA9-9D4B-4D6C-8234-EFD9E8C63476"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.1:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D8729BC1-FB09-4E6D-A5D5-8BDC589555B6"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.1:r3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D72C3DF-4513-48AC-AAED-C1AADF0794E1"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.1:r3-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C583289-96C4-4451-A320-14CA1C390819"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.2:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "620B0CDD-5566-472E-B96A-31D2C12E3120"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.2:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EA3DC63-B290-4D15-BEF9-21DEF36CA2EA"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.2:r1-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7E1E57AF-979B-4022-8AD6-B3558E06B718"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.2:r1-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "144730FB-7622-4B3D-9C47-D1B7A7FB7EB0"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.2:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7BA246F0-154E-4F44-A97B-690D22FA73DD"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.2:r2-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25D6C07C-F96E-4523-BB54-7FEABFE1D1ED"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.2:r2-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B70C784-534B-4FAA-A5ED-3709656E2B97"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.2:r3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60448FFB-568E-4280-9261-ADD65244F31A"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.3:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EC38173-44AB-43D5-8C27-CB43AD5E0B2E"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.3:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5A4DD04A-DE52-46BE-8C34-8DB47F7500F0"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.3:r1-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FEE0E145-8E1C-446E-90ED-237E3B9CAF47"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.3:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F26369D-21B2-4C6A-98C1-492692A61283"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.3:r2-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24003819-1A6B-4BDF-B3DF-34751C137788"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.3:r2-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF8D332E-9133-45B9-BB07-B33C790F737A"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.4:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E907193-075E-45BC-9257-9607DB790D71"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.4:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B73A41D-3FF5-4E53-83FF-74DF58E0D6C3"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.4:r1-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEDF46A8-FC3A-4779-B695-2CA11D045AEB"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:21.4:r1-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39809219-9F87-4583-9DAD-9415DD320B36"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.1:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "750FE748-82E7-4419-A061-2DEA26E35309"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.1:r1-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "236E23E5-8B04-4081-9D97-7300DF284000"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.1:r1-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5FC96EA7-90A7-4838-B95D-60DBC88C7BC7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:juniper:ptx1000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0E6DF99D-E438-4943-BC32-F2821E72AE0B"}, {"criteria": "cpe:2.3:h:juniper:ptx1000-72q:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B219F54A-4474-48CB-80F1-D988A719C3DA"}, {"criteria": "cpe:2.3:h:juniper:ptx10000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "249F6266-4ED6-4464-9347-9322E1481D0D"}, {"criteria": "cpe:2.3:h:juniper:ptx10001:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6CDCCB33-D428-4D64-977E-71C62F89AE5A"}, {"criteria": "cpe:2.3:h:juniper:ptx10001-36mr:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C188428C-0558-44FB-845C-E885DE9A0733"}, {"criteria": "cpe:2.3:h:juniper:ptx100016:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "37F94757-34CE-4F88-A6D3-544FE6A476D5"}, {"criteria": "cpe:2.3:h:juniper:ptx10002:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "82B22AC2-B794-4F12-9EB3-9AA6E4B19831"}, {"criteria": "cpe:2.3:h:juniper:ptx10002-60c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1B5462DF-5CF1-4DF9-989B-622EA734964F"}, {"criteria": "cpe:2.3:h:juniper:ptx10003:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5BD05415-9F94-4EB8-805A-C9C0FFA9D0DF"}, {"criteria": "cpe:2.3:h:juniper:ptx10003_160c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B1E88A41-B158-4A66-9DFD-438931C6BE68"}, {"criteria": "cpe:2.3:h:juniper:ptx10003_80c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2C97FFB5-8755-474B-ABCF-98DC7659208E"}, {"criteria": "cpe:2.3:h:juniper:ptx10003_81cd:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FAECB1BF-0F3A-4AD9-AF6B-E54A13D9D804"}, {"criteria": "cpe:2.3:h:juniper:ptx10004:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C432E543-37F5-4CA0-B239-2B97C6A16907"}, {"criteria": "cpe:2.3:h:juniper:ptx10008:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "65A64A26-4606-4D33-8958-5A3B7FFC4CDB"}, {"criteria": "cpe:2.3:h:juniper:ptx10016:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1879799F-18B2-4958-AA90-FD19348C889F"}, {"criteria": "cpe:2.3:h:juniper:ptx3000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "516476F9-7D4C-494F-99AA-750F4467CD15"}, {"criteria": "cpe:2.3:h:juniper:ptx5000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "654140A0-FEC0-4DB4-83BF-ECCB000DFA4D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "sirt@juniper.net"}