CVE-2021-38364

An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently modify or delete the existing flow rules related to other intents...

CVE-2022-24109

The CVE-2022-24109 entry concerns the Open Networking Foundation ONOS 2.5.1. An attacker can install a duplicate intent (with a different key) for an intent installed by a normal user, then remove the duplicate; this action removes the flow rules of the original intent even though the intent rema...

Open Networking Foundation ONOS 安全漏洞

Open Networking Foundation ONOS is an open source SDN controller from Open Networking Foundation open source. It is used to build next-generation SDN/NFV solutions. A security vulnerability exists in Open Networking Foundation ONOS version 2.5.1, which stems from incorrect flow rules installed by...

CVE-2022-29609

CVE-2022-29609 affects ONOS 2.5.1. The issue is that an intent with the same source and destination can appear in the INSTALLING state, suggesting its flow rules are installing. This incorrect handling is described as misleading to a network operator. The connected documents confirm the affected ...

PT-2023-12980 · Onos · Onos

Name of the Vulnerable Software and Affected Versions: ONOS version 2.5.1 Description: An issue was discovered where IntentManager attempts to install IPv6 flow rules of an intent into an OpenFlow 1.0 switch that does not support IPv6. This is due to improper handling of the difference in...

CVE-2022-24109

An issue was discovered in ONOS 2.5.1. To attack an intent installed by a normal user, a remote attacker can install a duplicate intent with a different key, and then remove the duplicate one. This will remove the flow rules of the intent, even though the intent still exists in the controller...

CVE-2022-29606

An issue was discovered in ONOS 2.5.1. An intent with a large port number shows the CORRUPT state, which is misleading to a network operator. Improper handling of such port numbers causes inconsistency between intent and flow rules in the network...

CVE-2022-29605

An issue was discovered in ONOS 2.5.1. IntentManager attempts to install the IPv6 flow rules of an intent into an OpenFlow 1.0 switch that does not support IPv6. Improper handling of the difference in capabilities of the intent and switch is misleading to a network operator...

CVE-2021-38364

An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently modify or delete the existing flow rules related to other intents...

CVE-2022-29606

ONOS 2.5.1 contains a vulnerability where an intent with large port numbers can enter a CORRUPT state, creating inconsistency between the declared intent and the resulting flow rules. Affected component is the intent handling/validation logic within the ONOS controller’s intent framework. The iss...

CVE-2021-38364

CVE-2021-38364 affects ONOS 2.5.1, where an incorrect comparison of flow rules installed by intents can let a remote attacker install or remove an intent and consequently modify or delete flow rules related to other intents. The consequence is unintended modification of flow state managed by the ...

CVE-2022-29609

An issue was discovered in ONOS 2.5.1. An intent with the same source and destination shows the INSTALLING state, indicating that its flow rules are installing. Improper handling of such an intent is misleading to a network operator...

CVE-2019-1010249

The Linux Foundation ONOS 2.0.0 and earlier is affected by: Integer Overflow. The impact is: A network administrator or attacker can install unintended flow rules in the switch by mistake. The component is: createFlow and createFlows functions in FlowWebResource.java RESTful service. The attack...

CVE-2019-1010250

The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator or attacker can install unintended flow rules in the switch by mistake. The component is: createFlow and createFlows functions in FlowWebResource.java RESTful service. The...

CVE-2019-1010252

The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator or attacker can install unintended flow rules in the switch by mistake. The component is: applyFlowRules and apply functions in FlowRuleManager.java. The attack vector is:...

CVE-2019-1010252

The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator or attacker can install unintended flow rules in the switch by mistake. The component is: applyFlowRules and apply functions in FlowRuleManager.java. The attack vector is:...

Input validation

The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator or attacker can install unintended flow rules in the switch by mistake. The component is: applyFlowRules and apply functions in FlowRuleManager.java. The attack vector is:...

Input validation

The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator or attacker can install unintended flow rules in the switch by mistake. The component is: createFlow and createFlows functions in FlowWebResource.java RESTful service. The...

Integer overflow

The Linux Foundation ONOS 2.0.0 and earlier is affected by: Integer Overflow. The impact is: A network administrator or attacker can install unintended flow rules in the switch by mistake. The component is: createFlow and createFlows functions in FlowWebResource.java RESTful service. The attack...

CVE-2019-1010249

The Linux Foundation ONOS 2.0.0 and earlier is affected by: Integer Overflow. The impact is: A network administrator or attacker can install unintended flow rules in the switch by mistake. The component is: createFlow and createFlows functions in FlowWebResource.java RESTful service. The attack...