Bug 1447856 (CVE-2017-1000361)

Summary:	CVE-2017-1000361 opendaylight: Port-Status packets sent to Controller create exceptions
Product:	[Other] Security Response	Reporter:	Summer Long <slong>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aortega, apevec, ayoung, chrisw, cvsbot-xmlrpc, jjoyce, jschluet, kbasil, lhh, lpeer, markmc, mkolesni, nyechiel, rbryant, sclewis, tdecacqu
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-08 00:40:31 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1447870, 1447871
Bug Blocks:	1444269

Description Summer Long 2017-05-04 04:56:25 UTC

DOMRpcImplementationNotAvailableException when sending Port-Status packets to OpenDaylight controller.
From thesis: https://aaltodoc.aalto.fi/bitstream/handle/123456789/21584/master_Bidaj_Andi_2016.pdf?sequence=1

Vulnerability 5: Sending the following Port-Status packet 040c005000000015020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 causes the controller to launch several DOMRpcImplementationNotAvailable
Exception-s and consume more resources. Number of created threads doubles and CPU consumption increases.

Comment 4 Summer Long 2017-05-04 05:50:26 UTC

Created opendaylight tracking bugs for this issue:

Affects: openstack-rdo [bug 1447871]

Comment 5 Summer Long 2017-05-24 04:51:02 UTC

Acknowledgments:

Name: OpenDaylight project
Upstream: Andi Bidaj

Comment 6 Summer Long 2017-05-24 04:52:52 UTC

Mitigation from upstream: https://wiki.opendaylight.org/view/Security_Advisories

Restricting access to the management network to ensure that only known, trusted devices can connect to the OpenFlow ports of OpenDaylight should minimize or eliminate the risk.

Comment 9 Andrej Nemec 2018-05-14 11:55:52 UTC

Statement:

This issue affects OpenDaylight in Red Hat OpenStack Platform 12.0 (Pike). However, OpenDaylight is only supported in segregated management networks; by default, at worst, this flaw would only be exposed on an admin network. For this reason, Red Hat Product Security has rated this issue as having security impact of Low. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.