CVE-2022-22209

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 21.2R3 Juniper Networks Junos OS versions prior to 21.3R2-S1, 21.3R3 Juniper Networks Junos OS versions prior to 21.4R1-S2, 21.4R2

Description A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause a Denial of Service (DoS). The Kernel Routing Table (KRT) queue can get stuck due to a memory leak triggered by interface flaps or route churn, leading to RIB and PFEs getting out of sync. This issue causes RTNEXTHOP/route and next-hop memory pressure and the KRT queue will eventually get stuck with the error 'ENOMEM -- Cannot allocate memory'. The out-of-sync state between RIB and FIB can be seen with the "show route" and "show route forwarding-table" commands. The KRT queue status can be checked using the CLI command "show krt queue". Messages indicating high memory for routes/nexthops will be observed in /var/log/messages.

Recommendations For Juniper Networks Junos OS versions prior to 21.2R3, update to version 21.2R3 or later. For Juniper Networks Junos OS versions prior to 21.3R2-S1, 21.3R3, update to version 21.3R2-S1, 21.3R3 or later. For Juniper Networks Junos OS versions prior to 21.4R1-S2, 21.4R2, update to version 21.4R1-S2, 21.4R2 or later. As a temporary workaround, consider monitoring the KRT queue status using the CLI command "show krt queue" and taking recovery actions when high memory for routes/nexthops is detected.