PT-2023-12336 · Onos · Onos

Published 2023-04-20 · Updated 2023-05-04 · CVE-2021-38364

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions ONOS version 2.5.1

Description An issue was discovered in ONOS where there is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently modify or delete the existing flow rules related to other intents.

Recommendations For ONOS version 2.5.1, consider restricting access to intent installation and removal functionality to minimize the risk of exploitation until a patch is available. As a temporary workaround, monitor flow rules closely for any unauthorized modifications. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-697

Related Identifiers

CVE-2021-38364

Affected Products

Onos

References · 6

• 🔥 https://usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2021-38364 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38364 · Security Note
• https://opennetworking.org/onos · Note
• https://t.me/cvenotify/48698 · Telegram Post
• https://t.me/cibsecurity/62521 · Telegram Post