Bug 1447856 (CVE-2017-1000361) - CVE-2017-1000361 opendaylight: Port-Status packets sent to Controller create exceptions
Summary: CVE-2017-1000361 opendaylight: Port-Status packets sent to Controller create ...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2017-1000361
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1447870 1447871
Blocks: 1444269
TreeView+ depends on / blocked
 
Reported: 2017-05-04 04:56 UTC by Summer Long
Modified: 2021-02-17 02:11 UTC (History)
16 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2017-08-08 00:40:31 UTC
Embargoed:


Attachments (Terms of Use)

Description Summer Long 2017-05-04 04:56:25 UTC
DOMRpcImplementationNotAvailableException when sending Port-Status packets to OpenDaylight controller.
From thesis: https://aaltodoc.aalto.fi/bitstream/handle/123456789/21584/master_Bidaj_Andi_2016.pdf?sequence=1

Vulnerability 5: Sending the following Port-Status packet 040c005000000015020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 causes the controller to launch several DOMRpcImplementationNotAvailable
Exception-s and consume more resources. Number of created threads doubles and CPU consumption increases.

Comment 4 Summer Long 2017-05-04 05:50:26 UTC
Created opendaylight tracking bugs for this issue:

Affects: openstack-rdo [bug 1447871]

Comment 5 Summer Long 2017-05-24 04:51:02 UTC
Acknowledgments:

Name: OpenDaylight project
Upstream: Andi Bidaj

Comment 6 Summer Long 2017-05-24 04:52:52 UTC
Mitigation from upstream: https://wiki.opendaylight.org/view/Security_Advisories

Restricting access to the management network to ensure that only known, trusted devices can connect to the OpenFlow ports of OpenDaylight should minimize or eliminate the risk.

Comment 9 Andrej Nemec 2018-05-14 11:55:52 UTC
Statement:

This issue affects OpenDaylight in Red Hat OpenStack Platform 12.0 (Pike). However, OpenDaylight is only supported in segregated management networks; by default, at worst, this flaw would only be exposed on an admin network. For this reason, Red Hat Product Security has rated this issue as having security impact of Low. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.


Note You need to log in before you can comment on or make changes to this bug.