title: Junos OS: BGP flap on NSR-enabled devices causes memory leak
description:
An Incomplete Cleanup vulnerability in Nonstop active routing (NSR) component of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause memory leak leading to Denial of Service (DoS).
On all Junos OS platforms, when NSR is enabled, a BGP flap will cause memory leak. A manual reboot of the system will restore the services.
Note: NSR is not supported on the SRX Series and is therefore not affected by this vulnerability.
The memory usage can be monitored using the below commands.
user@host> show chassis routing-engine no-forwarding
user@host> show system memory | no-more
This issue affects:
Juniper Networks Junos OS
*  21.2 versions earlier than 21.2R3-S5;
*  21.3 versions earlier than 21.3R3-S4;
*  21.4 versions earlier than 21.4R3-S4;
*  22.1 versions earlier than 22.1R3-S2;
*  22.2 versions earlier than 22.2R3-S2;
*  22.3 versions earlier than 22.3R2-S1, 22.3R3;
*  22.4 versions earlier than 22.4R1-S2, 22.4R2.
This issue does not affect Junos OS versions earlier than 20.4R3-S7.
problem types: CWE-459 Incomplete Cleanup
affected:
{
defaultStatus: unaffected
platforms: [MX Series, PTX Series, ACX Series, EX Series, QFX Series]
product: Junos OS
vendor: Juniper Networks
versions:
lessThan: 21.2R3-S5, status: affected, version: 21.2, versionType: semver
lessThan: 21.3R3-S4, status: affected, version: 21.3, versionType: semver
lessThan: 21.4R3-S4, status: affected, version: 21.4, versionType: semver
lessThan: 22.1R3-S2, status: affected, version: 22.1, versionType: semver
lessThan: 22.2R3-S2, status: affected, version: 22.2, versionType: semver
lessThan: 22.3R2-S1, 22.3R3, status: affected, version: 22.3, versionType: semver
lessThan: 22.4R1-S2, 22.4R2, status: affected, version: 22.4, versionType: semver
lessThan: 20.4R3-S7, status: unaffected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: The following software releases have been updated to resolve this specific issue: Junos OS 21.2R3-S5, 21.3R3-S4, 21.4R3-S4, 22.1R3-S2, 22.2R3-S2, 22.3R2-S1, 22.3R3, 22.4R1-S2, 22.4R2, 23.2R1, and all subsequent releases.
workarounds: There are no known workarounds for this issue.