LiveActive security incident?Get immediate response
CVE Record

CVE-2022-22215: Junos OS and Junos OS Evolved: /var/run/<pid>.env files are potentially not deleted during termination of a gRPC connection causing inode exhaustion

A Missing Release of File Descriptor or Handle after Effective Lifetime vulnerability in plugable authentication module (PAM) of Juniper Networks Junos OS and Junos OS Evolved allows a locally authenticated attacker with low privileges to cause a Denial of Service (DoS). It is possible that after the termination of a gRPC connection the respective/var/run/<pid>.env file is not getting deleted which if occurring repeatedly can cause inode exhaustion. Inode exhaustion can present itself in two different ways: 1. The following log message can be observed: host kernel: pid <pid> (<process>), uid <uid> inumber <number> on /.mount/var: out of inodes which by itself is a clear indication. 2. The following log message can be observed: host <process>[<pid>]: ... : No space left on device which is not deterministic and just a representation of a write error which could have several reasons. So the following check needs to be done: user@host> show system storage no-forwarding Filesystem Size Used Avail Capacity Mounted on /dev/ada1p1 475M 300M 137M 69% /.mount/var which indicates that the write error is not actually due to a lack of disk space. If either 1. or 2. has been confirmed, then the output of: user@host> file list /var/run/*.env | count need to be checked and if it indicates a high (>10000) number of files the system has been affected by this issue. This issue affects: Juniper Networks Junos OS All versions prior to 19.1R3-S8; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S5; 19.4 versions prior to 19.4R2-S6, 19.4R3-S7; 20.1 version 20.1R1 and later versions; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S4; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R2. Juniper Networks Junos OS Evolved All versions prior to 20.4R3-EVO; 21.1 versions prior to 21.1R3-S1-EVO; 21.2 versions prior to 21.2R1-S1-EVO, 21.2R2-EVO.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

A low-privileged authenticated user can trigger repeated gRPC connection cleanup failures on affected Juniper Junos systems. Leftover /var/run/<pid>.env files may consume all available inodes, causing write failures and a denial of service even when disk space appears available.

Executive priority

Treat as a maintenance-priority availability risk for Juniper network infrastructure. It is not evidenced as actively exploited, but successful abuse can disrupt device operation through inode exhaustion, so exposed affected systems should be patched during the next defensible change window.

Technical view

The vulnerability is a lifecycle cleanup failure in Junos OS and Junos OS Evolved PAM handling. After gRPC connection termination, related /var/run/<pid>.env files may remain. Repetition can exhaust inodes on /.mount/var, producing kernel out-of-inodes logs or nondeterministic “No space left on device” errors.

Likely exposure

Exposure is limited to affected Junos OS and Junos OS Evolved versions listed by Juniper. The issue requires an authenticated low-privileged attacker, but availability impact is high if inode exhaustion occurs on operational network devices.

Exploitation context

The provided sources do not support active exploitation, and the CVE is not listed as KEV. The described scenario requires repeated triggering after gRPC connection termination by a low-privileged authenticated attacker.

Researcher notes

The key evidence is Juniper’s description of persistent /var/run/<pid>.env files after gRPC termination. Validation should correlate affected versions, inode-related logs, storage output showing free space, and high .env file counts. No exploit proof or alternative workaround is provided in the supplied sources.

Mitigation direction

  • Upgrade Junos OS or Junos OS Evolved to a fixed release identified by Juniper.
  • Review Juniper JSA69719 for exact fixed versions in each affected release train.
  • If immediate upgrade is not possible, monitor inode exhaustion indicators closely.
  • Restrict low-privileged access to management functions where operationally feasible.

Validation and detection

  • Confirm whether devices run affected Junos OS or Junos OS Evolved versions.
  • Review logs for out-of-inodes messages on /.mount/var.
  • Investigate “No space left on device” errors where storage still shows free capacity.
  • Check whether /var/run/*.env file counts are unusually high, especially above 10000.
  • Prioritize validation on systems using gRPC management connections.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-22215 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H2.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.5Medium
CVSS 3.1 vector shape for CVE-2022-22215Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Juniper NetworksJunos OSunspecified, 19.2, 19.3, 19.4, 20.1R1, 20.2, 20.3, 20.4, 21.1, 21.2Listed
Juniper NetworksJunos OS Evolvedunspecified, 21.1, 21.2Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.