CVE-2018-1000155
📋 TL;DR
This vulnerability in OpenFlow allows attackers to spoof DPID values during the OpenFlow handshake, enabling denial of service attacks and unauthorized network access. It affects any system using OpenFlow version 1.0 or later for software-defined networking. Network controllers that trust DPID values without proper validation are vulnerable.
💻 Affected Systems
- OpenFlow implementations
- SDN controllers using OpenFlow
- Network switches with OpenFlow support
📦 What is this software?
Openflow by Opennetworking
⚠️ Risk & Real-World Impact
Worst Case
Complete network disruption through DoS, unauthorized administrative access to network infrastructure, and potential lateral movement through compromised controllers.
Likely Case
Network instability and service disruption through DoS attacks, with potential for unauthorized access to network segments.
If Mitigated
Minimal impact with proper DPID validation and network segmentation in place.
🎯 Exploit Status
Exploitation requires establishing a transport connection to the OpenFlow controller, which is typically straightforward in vulnerable configurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Varies by vendor - check specific OpenFlow implementation
Vendor Advisory: https://opennetworking.org/security-advisories/
Restart Required: Yes
Instructions:
1. Identify your OpenFlow implementation and version. 2. Check vendor for specific patches. 3. Apply patches that implement DPID validation. 4. Restart OpenFlow services. 5. Verify DPID validation is working.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to OpenFlow controllers to trusted networks only
iptables -A INPUT -p tcp --dport 6633 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 6633 -j DROP
DPID Whitelisting
allImplement DPID validation at controller level if not patched
# Configuration varies by controller - implement DPID validation logic
🧯 If You Can't Patch
- Implement strict network access controls to OpenFlow controllers
- Deploy intrusion detection systems to monitor for DPID spoofing attempts
🔍 How to Verify
Check if Vulnerable:
Test if OpenFlow controller accepts spoofed DPID values during handshake using available PoC toolsCheck Version:
Check OpenFlow implementation documentation or use vendor-specific version commandsVerify Fix Applied:
Verify that DPID validation is implemented and spoofed DPID values are rejected📡 Detection & Monitoring
Log Indicators:
- Multiple connection attempts with different DPIDs
- Unexpected DPID values in OpenFlow logs
- Failed handshake attempts
Network Indicators:
- Unusual OpenFlow handshake patterns
- Traffic to OpenFlow port 6633 from untrusted sources
- Multiple TCP connections to controller
SIEM Query:
source_port=6633 AND (event_type="openflow_handshake" OR protocol="openflow") | stats count by src_ip, dpid