Bug 1447190 (CVE-2017-1000358) - CVE-2017-1000358 opendaylight: uncaught exception by odl-restconf feature
Summary: CVE-2017-1000358 opendaylight: uncaught exception by odl-restconf feature
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2017-1000358
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1447863 1447864
Blocks: 1444269
TreeView+ depends on / blocked
 
Reported: 2017-05-02 05:08 UTC by Summer Long
Modified: 2021-02-17 02:12 UTC (History)
16 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2017-08-08 00:38:52 UTC
Embargoed:


Attachments (Terms of Use)

Description Summer Long 2017-05-02 05:08:44 UTC
Denial of Service in OpenDaylight (adding flows). Controller throws an exception and does not allow user to add subsequent flows for a particular switch.
From thesis: https://aaltodoc.aalto.fi/bitstream/handle/123456789/21584/master_Bidaj_Andi_2016.pdf?sequence=1

Vulnerability 2: The exploit sends several equal REST API requests to add [a flow]. The first requests are successful and the controller returns the transaction ID. After a certain number of successful requests, the controller returns the stack trace of a NullPointerException in the HTTP response. Afterwards, the user is not able to add flows to the same switch, unless the controller is restarted.

Comment 2 Summer Long 2017-05-02 05:09:11 UTC
Acknowledgments:

Name: OpenDaylight project
Upstream: Andi Bidaj

Comment 4 Summer Long 2017-05-04 05:42:26 UTC
Created opendaylight tracking bugs for this issue:

Affects: openstack-rdo [bug 1447863]

Comment 5 Summer Long 2017-05-24 04:46:21 UTC
Mitigation from upstream: https://wiki.opendaylight.org/view/Security_Advisories

Ensuring that only restricted users can add flows to devices and that they do not repeatedly add the same flow should minimize or eliminate risk of the attack.

Comment 8 Andrej Nemec 2018-05-14 11:55:25 UTC
Statement: 

This issue affects OpenDaylight in Red Hat OpenStack Platform 12.0 (Pike). However, OpenDaylight is only supported in segregated management networks; by default, at worst, this flaw would only be exposed on an admin network. For this reason, Red Hat Product Security has rated this issue as having security impact of Low. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.


Note You need to log in before you can comment on or make changes to this bug.