Bug 1447856 – CVE-2017-1000361 opendaylight: Port-Status packets sent to Controller create exceptions

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1447856 - (CVE-2017-1000361) CVE-2017-1000361 opendaylight: Port-Status packets sent to Controller create exceptions

Summary:	CVE-2017-1000361 opendaylight: Port-Status packets sent to Controller create ...

Status:	CLOSED WONTFIX

Aliases:	CVE-2017-1000361

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20170421,reported=2...
Keywords:	Security

Depends On:	1447871 1447870
Blocks:	1444269
	Show dependency tree / graph

Reported:	2017-05-04 00:56 EDT by Summer Long
Modified:	2018-05-14 07:55 EDT (History)
CC List:	16 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-08-07 20:40:31 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Summer Long 2017-05-04 00:56:25 EDT

DOMRpcImplementationNotAvailableException when sending Port-Status packets to OpenDaylight controller.
From thesis: https://aaltodoc.aalto.fi/bitstream/handle/123456789/21584/master_Bidaj_Andi_2016.pdf?sequence=1

Vulnerability 5: Sending the following Port-Status packet 040c005000000015020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 causes the controller to launch several DOMRpcImplementationNotAvailable
Exception-s and consume more resources. Number of created threads doubles and CPU consumption increases.

Comment 4 Summer Long 2017-05-04 01:50:26 EDT

Created opendaylight tracking bugs for this issue:

Affects: openstack-rdo [bug 1447871]

Comment 5 Summer Long 2017-05-24 00:51:02 EDT

Acknowledgments:

Name: OpenDaylight project
Upstream: Andi Bidaj

Comment 6 Summer Long 2017-05-24 00:52:52 EDT

Mitigation from upstream: https://wiki.opendaylight.org/view/Security_Advisories

Restricting access to the management network to ensure that only known, trusted devices can connect to the OpenFlow ports of OpenDaylight should minimize or eliminate the risk.

Comment 9 Andrej Nemec 2018-05-14 07:55:52 EDT

Statement:

This issue affects OpenDaylight in Red Hat OpenStack Platform 12.0 (Pike). However, OpenDaylight is only supported in segregated management networks; by default, at worst, this flaw would only be exposed on an admin network. For this reason, Red Hat Product Security has rated this issue as having security impact of Low. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Note You need to log in before you can comment on or make changes to this bug.