CVE-2021-38363
📋 TL;DR
This vulnerability in ONOS (Open Network Operating System) allows memory exhaustion through orphaned intents that cannot be cleaned up. When an intent installation fails with an exception, it remains stuck in memory indefinitely, consuming resources. This affects ONOS deployments where intents are used for network configuration.
💻 Affected Systems
- ONOS (Open Network Operating System)
📦 What is this software?
Onos by Opennetworking
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service as memory fills with orphaned intents, causing ONOS controller to crash and disrupting all managed network services.
Likely Case
Gradual performance degradation and eventual service disruption as memory consumption increases over time.
If Mitigated
Controlled memory growth with monitoring and restart procedures, but still requires eventual remediation.
🎯 Exploit Status
Exploitation requires network management access to create intents. The vulnerability is triggered by normal operations that fail unexpectedly.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check ONOS release notes for versions after 2.5.1
Vendor Advisory: https://opennetworking.org/onos/
Restart Required: Yes
Instructions:
1. Check ONOS documentation for patched versions. 2. Backup current configuration. 3. Upgrade to patched version. 4. Restart ONOS service. 5. Verify intent functionality.
🔧 Temporary Workarounds
Monitor and manually clean intents
allRegularly monitor intent status and manually remove stuck intents before memory exhaustion occurs
onos> intents
onos> remove-intent <intent-id>
Limit intent creation
allRestrict who can create intents and implement validation to prevent problematic intent requests
🧯 If You Can't Patch
- Implement aggressive memory monitoring with alerts for abnormal growth
- Establish regular ONOS restart schedule to clear accumulated orphaned intents
🔍 How to Verify
Check if Vulnerable:
Check ONOS version: 'onos-version' command. Monitor memory usage and check for intents stuck in pending state.Check Version:
onos-versionVerify Fix Applied:
After patching, test intent creation and deletion, monitor memory usage over time for abnormal growth.📡 Detection & Monitoring
Log Indicators:
- Repeated intent installation failures
- Memory usage warnings
- Intent cleanup process errors
Network Indicators:
- Increased latency in network configuration changes
- Unresponsive ONOS management interfaces
SIEM Query:
source="onos" AND ("intent failed" OR "memory high" OR "pendingMap")