CVE-2022-24035
📋 TL;DR
A vulnerability in ONOS 2.5.1's intent framework causes purge-requested intents to remain active but unresponsive to topology changes like link failures. This can lead to network management failures when combined with other applications. Organizations using ONOS for software-defined networking are affected.
💻 Affected Systems
- ONOS (Open Network Operating System)
📦 What is this software?
Onos by Opennetworking
⚠️ Risk & Real-World Impact
Worst Case
Cascading network failures causing complete loss of network management and control plane functionality across the SDN infrastructure.
Likely Case
Degraded network performance, routing inconsistencies, and partial loss of network management capabilities.
If Mitigated
Minimal impact with proper monitoring and failover mechanisms in place.
🎯 Exploit Status
Exploitation requires specific conditions: purge-requested intents combined with topology changes and other applications. Academic research paper exists but no public exploit code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions of ONOS (check ONOS project updates post-2.5.1)
Vendor Advisory: https://wiki.onosproject.org/display/ONOS/Security+Advisories
Restart Required: Yes
Instructions:
1. Check ONOS security advisories for specific patch version. 2. Backup current configuration. 3. Upgrade ONOS to patched version. 4. Restart ONOS services. 5. Verify intent framework functionality.
🔧 Temporary Workarounds
Manual Intent Cleanup
linuxRegularly monitor and manually remove stale purge-requested intents before topology changes occur
onos> intents
onos> remove-intent <intent-id>
Reduce Intent Timeout
linuxConfigure shorter intent timeout values to automatically clean up stale intents faster
onos> cfg set org.onosproject.net.intent.IntentCleanupService purgeFrequency "30s"
🧯 If You Can't Patch
- Implement aggressive monitoring of intent states and topology changes with automated alerts
- Isolate ONOS controller from production traffic during maintenance windows when topology changes are planned
🔍 How to Verify
Check if Vulnerable:
Check ONOS version: onos> version. If version is 2.5.1 or other affected versions, test by creating intents, requesting purge, then simulating link failures to see if intents remain unresponsive.Check Version:
onos> versionVerify Fix Applied:
After upgrade, repeat the test scenario: create intent, request purge, simulate link failure, verify intent properly responds or gets cleaned up.📡 Detection & Monitoring
Log Indicators:
- Intent purge requests without subsequent cleanup
- Link failure events while purge-requested intents remain active
- Network management application errors
Network Indicators:
- Unexpected routing behavior
- Increased network management protocol errors
- Control plane inconsistencies
SIEM Query:
source="onos" AND ("purge-requested" OR "intent cleanup") AND ("link down" OR "topology change")