CVE-2022-22169: 2022-01 Security Bulletin: Junos OS and Junos OS Evolved: OSPFv3 session might go into INIT state upon receipt of multiple crafted packets from a trusted neighbor device. (CVE-2022-22169)

• printer Print
• border_color Report a Security Vulnerability

2022-01 Security Bulletin: Junos OS and Junos OS Evolved: OSPFv3 session might go into INIT state upon receipt of multiple crafted packets from a trusted neighbor device. (CVE-2022-22169)

Article ID: JSA11276 SECURITY_ADVISORIES Last Updated: 12 Jan 2022Version: 1.0 Product Affected:

This issue affects Junos OS 15.1, 18.3, 18.4, 19.1, 19.2, 19.3, 19.4, 20.1, 20.2, 20.3, 20.4, 21.1, 21.2. This issue affects Junos OS Evolved any releases prior to 21.2R2-EVO.

Problem:

An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who sends specific packets in certain orders and at specific timings to force OSPFv3 to unexpectedly enter graceful-restart (GR helper mode) even though there is not any Grace-LSA received in OSPFv3 causing a Denial of Service (DoS). Unexpectedly entering GR helper mode might cause the OSPFv3 neighbor adjacency formed on this interface to be stuck in the “INIT” state which can be observed by issuing the following command:

user@device> show ospf3 neighbor
ID Interface State
xx.xx.xx.xx ae100.0 Init <<<<<<<<<<

An indicator of compromise can be seen in log files when traceoptions for OSPFv3 are enabled before the issue occurs. These logfile messages are as follows:

OSPF restart signaling: Received hello with LR bit set from nbr ip=xx::xx id=xx.xx.xx.xx. Set oob-resync capabilty 1.
OSPF Restart Signaling: Start helper mode for nbr ip xx::xx id xx.xx.xx.xx
OSPF restart signaling: abort helper mode for nbr ip=xx::xx id=xx.xx.xx.xx
OSPF neighbor xx::xx (realm ipv6-unicast <interface.unit> area xx.xx.xx.xx) state changed from Full to Init due to 1WayRcvd (event reason: neighbor is in one-way mode) (nbr helped: 0)

This issue affects:

Juniper Networks Junos OS

• 15.1 versions prior to 15.1R7-S11;
• 18.3 versions prior to 18.3R3-S6;
• 18.4 versions prior to 18.4R2-S9, 18.4R3-S10;
• 19.1 versions prior to 19.1R2-S3, 19.1R3-S7;
• 19.2 versions prior to 19.2R1-S7, 19.2R3-S4;
• 19.3 versions prior to 19.3R2-S7, 19.3R3-S4;
• 19.4 versions prior to 19.4R3-S6;
• 20.1 versions prior to 20.1R3-S1;
• 20.2 versions prior to 20.2R3-S3;
• 20.3 versions prior to 20.3R3-S1;
• 20.4 versions prior to 20.4R2-S2, 20.4R3;
• 21.1 versions prior to 21.1R3;
• 21.2 versions prior to 21.2R1-S1, 21.2R2.

This issue does not affect any version of Juniper Networks Junos OS 12.3.

This issue affects Juniper Networks Junos OS Evolved all versions prior to 21.2R2-EVO.

The following minimal configuration is required:

You must activate both OSPF and OSPF3 on one or more of the same interfaces concurrently on a device with an established peer with both OSPF and OSPF3 also activated, and sessions established.

An example of minimal details are:

[protocols ospf]
[protocols ospf3]

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was seen during production usage.

This issue has been assigned CVE-2022-22169.

Solution:

The following software releases have been updated to resolve this specific issue:

Junos OS: 15.1R7-S11, 18.3R3-S6, 18.4R2-S9, 18.4R3-S10, 19.1R2-S3, 19.1R3-S7, 19.2R1-S7, 19.2R3-S4, 19.3R2-S7, 19.3R3-S4, 19.4R3-S6, 20.1R3-S1, 20.2R3-S3, 20.3R3-S1, 20.4R2-S2, 20.4R3, 21.1R3, 21.2R1-S1, 21.2R2, 21.3R1, and all subsequent releases.

Junos OS Evolved: 21.2R2-EVO, 21.3R1-EVO, and all subsequent releases.

This issue is being tracked as 1599491.

Workaround:

To work around this issue, disable the OSPF GR helper mode for OSPFv3:

[protocols ospf3 graceful-restart helper-disable]

There are no other workarounds for this issue.

Implementation:

Software releases or updates are available for download at https://support.juniper.net/support/downloads/.

Modification History:

2022-01-12: Initial Publication.

CVSS Score:

5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Severity Level:

Medium

Severity Assessment:

Information for how Juniper Networks uses CVSS can be found at KB 16446 “Common Vulnerability Scoring System (CVSS) and Juniper’s Security Advisories.”

Related Links

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process
• KB16765: In which releases are vulnerabilities fixed?
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper’s Security Advisories
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2022-22169 at www.cve.org

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

• Junos
• MX-series
• EX Series
• SRX Series
• QFX Series
• NFX Series
• PTX Series
• Virtual Route Reflector
• SIRT Advisory
• ACX Series
• Junos OS Evolved