Junos OS and Junos OS Evolved: OSPFv3 session might go into INIT state upon receipt of multiple crafted packets from a trusted neighbor device.

Description

An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who sends specific packets in certain orders and at specific timings to force OSPFv3 to unexpectedly enter graceful-restart (GR helper mode) even though there is not any Grace-LSA received in OSPFv3 causing a Denial of Service (DoS). Unexpectedly entering GR helper mode might cause the OSPFv3 neighbor adjacency formed on this interface to be stuck in the "INIT" state which can be observed by issuing the following command: user@device> show ospf3 neighbor ID Interface State xx.xx.xx.xx ae100.0 Init <<<<<<<<<< An indicator of compromise can be seen in log files when traceoptions for OSPFv3 are enabled before the issue occurs. These logfile messages are as follows: OSPF restart signaling: Received hello with LR bit set from nbr ip=xx::xx id=xx.xx.xx.xx. Set oob-resync capabilty 1. OSPF Restart Signaling: Start helper mode for nbr ip xx::xx id xx.xx.xx.xx OSPF restart signaling: abort helper mode for nbr ip=xx::xx id=xx.xx.xx.xx OSPF neighbor xx::xx (realm ipv6-unicast <interface.unit> area xx.xx.xx.xx) state changed from Full to Init due to 1WayRcvd (event reason: neighbor is in one-way mode) (nbr helped: 0) This issue affects: Juniper Networks Junos OS. 15.1 versions prior to 15.1R7-S11; 18.3 versions prior to 18.3R3-S6; 18.4 versions prior to 18.4R2-S9, 18.4R3-S10; 19.1 versions prior to 19.1R2-S3, 19.1R3-S7; 19.2 versions prior to 19.2R1-S7, 19.2R3-S4; 19.3 versions prior to 19.3R2-S7, 19.3R3-S4; 19.4 versions prior to 19.4R3-S6; 20.1 versions prior to 20.1R3-S1; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R2-S2, 20.4R3; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R1-S1, 21.2R2. This issue does not affect any version of Juniper Networks Junos OS 12.3. This issue affects Juniper Networks Junos OS Evolved all versions prior to 21.2R2-EVO.

Timeline

Scores

EPSS (exploitation in 30 days)

0.83% · top 42% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.

Weakness

• Denial of Service (DoS)
• CWE-665 Improper Initialization (opens in a new tab)All about CWE-665 and its CVEs

Affected products

• Juniper Networks · Junos OS

  • unaffected 12.3 Any
  • affected 15.1 – < 15.1R7-S11
  • affected 18.3 – < 18.3R3-S6
  • affected 18.4 – < 18.4R2-S9, 18.4R3-S10
  • affected 19.1 – < 19.1R2-S3, 19.1R3-S7
  • affected 19.2 – < 19.2R1-S7, 19.2R3-S4
  • affected 19.3 – < 19.3R2-S7, 19.3R3-S4
  • affected 19.4 – < 19.4R3-S6
  • affected 20.1 – < 20.1R3-S1
  • affected 20.2 – < 20.2R3-S3
  • affected 20.3 – < 20.3R3-S1
  • affected 20.4 – < 20.4R2-S2, 20.4R3
  • affected 21.1 – < 21.1R3
  • affected 21.2 – < 21.2R1-S1, 21.2R2

• Juniper Networks · Junos OS Evolved

  • affected unspecified – < 21.2R2-EVO

What to do

Solution: The following software releases have been updated to resolve this specific issue: Junos OS: 15.1R7-S11, 18.3R3-S6, 18.4R2-S9, 18.4R3-S10, 19.1R2-S3, 19.1R3-S7, 19.2R1-S7, 19.2R3-S4, 19.3R2-S7, 19.3R3-S4, 19.4R3-S6, 20.1R3-S1, 20.2R3-S3, 20.3R3-S1, 20.4R2-S2, 20.4R3, 21.1R3, 21.2R1-S1, 21.2R2, 21.3R1, and all subsequent releases. Junos OS Evolved: 21.2R2-EVO, 21.3R1-EVO, and all subsequent releases.

Workaround: To work around this issue, disable the OSPF GR helper mode for OSPFv3: [protocols ospf3 graceful-restart helper-disable] There are no other workarounds for this issue.

Exploitation: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

References (1)

• https://kb.juniper.net/JSA11276 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-22169](https://trackcve.app/badge/CVE-2022-22169.svg)](https://trackcve.app/cve/CVE-2022-22169)

Record last updated 17 Sept 2024, 00:35 UTC.