CVE-2020-35139
📋 TL;DR
CVE-2020-35139 is a denial-of-service vulnerability in Faucet SDN Ryu's parser.py where specially crafted OFPBundleCtrlMsg messages can trigger an infinite loop. This affects network administrators using Ryu SDN controllers version 4.34. Remote attackers can crash the controller by sending malicious OpenFlow messages.
💻 Affected Systems
- Faucet SDN Ryu
📦 What is this software?
Ryu by Faucet
⚠️ Risk & Real-World Impact
Worst Case
Complete controller crash leading to network downtime, loss of SDN control plane functionality, and disruption of all managed network traffic.
Likely Case
Controller becomes unresponsive, requiring manual restart and causing temporary network disruption until service is restored.
If Mitigated
Minimal impact with proper network segmentation and controller redundancy in place.
🎯 Exploit Status
The vulnerability is in the parser logic and can be triggered by sending specially crafted OpenFlow messages without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 4.34 (specifically fixed in subsequent commits)
Vendor Advisory: https://github.com/faucetsdn/ryu/issues/118
Restart Required: Yes
Instructions:
1. Update Ryu to a version after 4.34. 2. Check the GitHub issue for specific commit fixes. 3. Restart the Ryu controller service after updating.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to Ryu controller management interface to trusted networks only.
iptables -A INPUT -p tcp --dport 6633 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 6633 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit who can communicate with the Ryu controller
- Deploy redundant controllers with load balancing to maintain service if one instance crashes
🔍 How to Verify
Check if Vulnerable:
Check Ryu version: if running version 4.34, the system is vulnerable. Review controller logs for infinite loop patterns or crashes.Check Version:
ryu-manager --versionVerify Fix Applied:
After updating, verify the version is no longer 4.34 and test controller stability with normal OpenFlow traffic.📡 Detection & Monitoring
Log Indicators:
- Controller process consuming 100% CPU continuously
- Repeated error messages about OFPBundleCtrlMsg parsing
- Controller crash/restart events
Network Indicators:
- Unusual volume of OpenFlow bundle control messages from single source
- Controller becoming unresponsive to legitimate OpenFlow requests
SIEM Query:
source="ryu.log" AND ("OFPBundleCtrlMsg" OR "infinite loop" OR "100% CPU")