CVE-2017-1000411— OpenDaylight OpenFlow Plugin和Controller 安全漏洞

N/A

OpenFlow Plugin and OpenDayLight Controller versions Nitrogen, Carbon, Boron, Robert Varga, Anil Vishnoi contain a flaw when multiple 'expired' flows take up the memory resource of CONFIG DATASTORE which leads to CONTROLLER shutdown. If multiple different flows with 'idle-timeout' and 'hard-timeout' are sent to the Openflow Plugin REST API, the expired flows will eventually crash the controller once its resource allocations set with the JVM size are exceeded. Although the installed flows (with timeout set) are removed from network (and thus also from controller's operations DS), the expired entries are still present in CONFIG DS. The attack can originate both from NORTH or SOUTH. The above description is for a north bound attack. A south bound attack can originate when an attacker attempts a flow flooding attack and since flows come with timeouts, the attack is not successful. However, the attacker will now be successful in CONTROLLER overflow attack (resource consumption). Although, the network (actual flow tables) and operational DS are only (~)1% occupied, the controller requests for resource consumption. This happens because the installed flows get removed from the network upon timeout.

N/A

N/A

OpenDaylight OpenFlow Plugin和Controller 安全漏洞

Opendaylight是美国Linux基金会的一个项目，是一套以社区为主导的开源软件定义网络框架，它包含一套模块合集，能够执行需要快速完成的网络任务。OpenDaylight OpenFlow Plugin是其中的一个新型网络交换模型；Controller是其中的一个控制器。 OpenDaylight OpenFlow Plugin和Controller中存在拒绝服务漏洞。远程攻击者可利用该漏洞造成拒绝服务（内存资源消耗）。以下版本受到影响：OpenDaylight OpenFlow Plugin Ni

N/A

N/A