What is CVE-2022-22178?

CVE-2022-22178 is a high-severity vulnerability in Juniper Junos, classified under Stack-based Buffer Overflow. CVSS score: 7.5/10. Published 2022-01-19.

How severe is CVE-2022-22178?

High severity. CVSS v3 base score is 7.5 out of 10.

Buffer overflow in Juniper Junos

CVE-2022-22178

A Stack-based Buffer Overflow vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on MX Series and SRX series allows an unauthenticated networked attacker to cause a flowd crash and thereby a Denial of Service (DoS). Continued receipt of these specific packets will cause a sustained Denial of Service condition. This issue can be triggered by a specific Session Initiation Protocol (SIP) invite packet if the SIP ALG is enabled. Due to this, the PIC will be rebooted and all traffic that traverses the PIC will be dropped. This issue affects: Juniper Networks Junos OS 20.4 versions prior to 20.4R3-S2; 21.1 versions prior to 21.1R2-S1, 21.1R3; 21.2 versions prior to 21.2R2; 21.3 versions prior to 21.3R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.4R1.

Vulnerability class: Buffer Overflow

EPSS: 0.009 (59.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Juniper Junos — versions 20.4, 21.1, 21.2
Juniper Mx10
Juniper Mx10000
Juniper Mx10003
Juniper Mx10008
Juniper Mx10016
Juniper Mx104
Juniper Mx150
Juniper Mx2008
Juniper Mx2010

Weakness classification (CWE)

CWE-121 — Stack-based Buffer Overflow

References

sirt@juniper.net (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2022-22178?: CVE-2022-22178 is a high-severity vulnerability in Juniper Junos, classified under Stack-based Buffer Overflow. CVSS score: 7.5/10. Published 2022-01-19.
How severe is CVE-2022-22178?: High severity. CVSS v3 base score is 7.5 out of 10.