CVE Vulnerabilities

CVE-2022-22207

Use After Free

Published: Jul 20, 2022 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

A Use After Free vulnerability in the Advanced Forwarding Toolkit (AFT) manager process (aftmand) of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause a kernel crash due to intensive polling of Abstracted Fabric (AF) interface statistics and thereby a Denial of Service (DoS). Continued gathering of AF interface statistics will create a sustained Denial of Service (DoS) condition. This issue affects Juniper Networks Junos OS on MX Series: 20.1 versions later than 20.1R1; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S4; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2; 21.2 versions prior to 21.2R2.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Name Vendor Start Version End Version
Junos Juniper 20.1-r1-s1 (including) 20.1-r1-s1 (including)
Junos Juniper 20.1-r1-s2 (including) 20.1-r1-s2 (including)
Junos Juniper 20.1-r1-s3 (including) 20.1-r1-s3 (including)
Junos Juniper 20.1-r1-s4 (including) 20.1-r1-s4 (including)
Junos Juniper 20.1-r2 (including) 20.1-r2 (including)
Junos Juniper 20.1-r2-s1 (including) 20.1-r2-s1 (including)
Junos Juniper 20.1-r2-s2 (including) 20.1-r2-s2 (including)
Junos Juniper 20.1-r3 (including) 20.1-r3 (including)
Junos Juniper 20.1-r3-s1 (including) 20.1-r3-s1 (including)
Junos Juniper 20.1-r3-s2 (including) 20.1-r3-s2 (including)
Junos Juniper 20.1-r3-s3 (including) 20.1-r3-s3 (including)
Junos Juniper 20.2 (including) 20.2 (including)
Junos Juniper 20.2-r1 (including) 20.2-r1 (including)
Junos Juniper 20.2-r1-s1 (including) 20.2-r1-s1 (including)
Junos Juniper 20.2-r1-s2 (including) 20.2-r1-s2 (including)
Junos Juniper 20.2-r1-s3 (including) 20.2-r1-s3 (including)
Junos Juniper 20.2-r2 (including) 20.2-r2 (including)
Junos Juniper 20.2-r2-s1 (including) 20.2-r2-s1 (including)
Junos Juniper 20.2-r2-s2 (including) 20.2-r2-s2 (including)
Junos Juniper 20.2-r2-s3 (including) 20.2-r2-s3 (including)
Junos Juniper 20.2-r3 (including) 20.2-r3 (including)
Junos Juniper 20.2-r3-s1 (including) 20.2-r3-s1 (including)
Junos Juniper 20.2-r3-s2 (including) 20.2-r3-s2 (including)
Junos Juniper 20.2-r3-s3 (including) 20.2-r3-s3 (including)
Junos Juniper 20.2-r3-s4 (including) 20.2-r3-s4 (including)
Junos Juniper 20.3 (including) 20.3 (including)
Junos Juniper 20.3-r1 (including) 20.3-r1 (including)
Junos Juniper 20.3-r1-s1 (including) 20.3-r1-s1 (including)
Junos Juniper 20.3-r1-s2 (including) 20.3-r1-s2 (including)
Junos Juniper 20.3-r2 (including) 20.3-r2 (including)
Junos Juniper 20.3-r2-s1 (including) 20.3-r2-s1 (including)
Junos Juniper 20.3-r3 (including) 20.3-r3 (including)
Junos Juniper 20.3-r3-s1 (including) 20.3-r3-s1 (including)
Junos Juniper 20.3-r3-s2 (including) 20.3-r3-s2 (including)
Junos Juniper 20.3-r3-s3 (including) 20.3-r3-s3 (including)
Junos Juniper 20.4 (including) 20.4 (including)
Junos Juniper 20.4-r1 (including) 20.4-r1 (including)
Junos Juniper 20.4-r1-s1 (including) 20.4-r1-s1 (including)
Junos Juniper 20.4-r2 (including) 20.4-r2 (including)
Junos Juniper 20.4-r2-s1 (including) 20.4-r2-s1 (including)
Junos Juniper 20.4-r2-s2 (including) 20.4-r2-s2 (including)
Junos Juniper 21.1 (including) 21.1 (including)
Junos Juniper 21.1-r1 (including) 21.1-r1 (including)
Junos Juniper 21.1-r1-s1 (including) 21.1-r1-s1 (including)
Junos Juniper 21.2 (including) 21.2 (including)
Junos Juniper 21.2-r1 (including) 21.2-r1 (including)
Junos Juniper 21.2-r1-s1 (including) 21.2-r1-s1 (including)
Junos Juniper 21.2-r1-s2 (including) 21.2-r1-s2 (including)

Potential Mitigations

References