CVE-2022-22155Junos OS: ACX5448: FPC memory leak due to IPv6 neighbor flaps

Description

An Uncontrolled Resource Consumption vulnerability in the handling of IPv6 neighbor state change events in Juniper Networks Junos OS allows an adjacent attacker to cause a memory leak in the Flexible PIC Concentrator (FPC) of an ACX5448 router. The continuous flapping of an IPv6 neighbor with specific timing will cause the FPC to run out of resources, leading to a Denial of Service (DoS) condition. Once the condition occurs, further packet processing will be impacted, creating a sustained Denial of Service (DoS) condition, requiring a manual PFE restart to restore service. The following error messages will be seen after the FPC resources have been exhausted: fpc0 DNX_NH::dnx_nh_tag_ipv4_hw_install(),3135: dnx_nh_tag_ipv4_hw_install: BCM L3 Egress create object failed for NH 602 (-14:No resources for operation), BCM NH Params: unit:0 Port:41, L3_INTF:0 Flags: 0x40 fpc0 DNX_NH::dnx_nh_tag_ipv4_hw_install(),3135: dnx_nh_tag_ipv4_hw_install: BCM L3 Egress create object failed for NH 602 (-14:No resources for operation), BCM NH Params: unit:0 Port:41, L3_INTF:0 Flags: 0x40 fpc0 DNX_NH::dnx_nh_tag_ipv4_hw_install(),3135: dnx_nh_tag_ipv4_hw_install: BCM L3 Egress create object failed for NH 602 (-14:No resources for operation), BCM NH Params: unit:0 Port:41, L3_INTF:0 Flags: 0x40 fpc0 DNX_NH::dnx_nh_tag_ipv4_hw_install(),3135: dnx_nh_tag_ipv4_hw_install: BCM L3 Egress create object failed for NH 602 (-14:No resources for operation), BCM NH Params: unit:0 Port:41, L3_INTF:0 Flags: 0x40 This issue only affects the ACX5448 router. No other products or platforms are affected by this vulnerability. This issue affects Juniper Networks Junos OS on ACX5448: 18.4 versions prior to 18.4R3-S10; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R1-S8, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S3, 19.4R2-S2, 19.4R3; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R1-S1, 20.2R2.

Timeline

Scores

EPSS (exploitation in 30 days)

0.38% · top 67% of all CVEs (12 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Affected products

• Juniper Networks · Junos OS

  • affected 18.4 – < 18.4R3-S10
  • affected 19.1 – < 19.1R3-S5
  • affected 19.2 – < 19.2R1-S8, 19.2R3-S2
  • affected 19.3 – < 19.3R2-S6, 19.3R3-S2
  • affected 19.4 – < 19.4R1-S3, 19.4R2-S2, 19.4R3
  • affected 20.1 – < 20.1R2
  • affected 20.2 – < 20.2R1-S1, 20.2R2

What to do

Solution: The following software releases have been updated to resolve this specific issue: Junos OS 18.4R3-S10, 19.1R3-S5, 19.2R1-S8, 19.2R3-S2, 19.3R2-S6, 19.3R3-S2, 19.4R1-S3, 19.4R2-S2, 19.4R3, 20.1R2, 20.2R1-S1, 20.2R2, 20.3R1, and all subsequent releases.

Workaround: There are no known workarounds for this issue.

Exploitation: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2022-27302 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-22155](https://cveledger.app/badge/CVE-2022-22155.svg)](https://cveledger.app/cve/CVE-2022-22155)

Record last updated 17 Sept 2024, 02:21 UTC.