CVE-2023-22412

Summary

An Improper Locking vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series with MS-MPC or MS-MIC card and SRX Series allows an unauthenticated, network-based attacker to cause a flow processing daemon (flowd) crash and thereby a Denial of Service (DoS). Continued receipt of these specific packets will cause a sustained Denial of Service condition. This issue occurs when SIP ALG is enabled and specific SIP messages are processed simultaneously. This issue affects: Juniper Networks Junos OS on MX Series and SRX Series 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S3; 21.2 versions prior to 21.2R3-S2; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R3; 22.1 versions prior to 22.1R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.4R1 on MX Series, or SRX Series.

Affected Software

VendorProductVersion RangeStatus
Juniper NetworksJunos OSunspecified < 20.4R1unaffected
Juniper NetworksJunos OS20.4 < 20.4R3-S4affected
Juniper NetworksJunos OS21.1 < 21.1R3-S3affected
Juniper NetworksJunos OS21.2 < 21.2R3-S2affected
Juniper NetworksJunos OS21.3 < 21.3R3affected
Juniper NetworksJunos OS21.4 < 21.4R3affected
Juniper NetworksJunos OS22.1 < 22.1R2affected

Weaknesses

  • CWE-667: CWE-667 Improper Locking
  • Denial of Service (DoS)

Workarounds

There are no known workarounds for this issue, but it should be considered to disable the SIP ALG if it's not strictly needed.

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References