CVE-2022-29604
📋 TL;DR
This vulnerability in ONOS (Open Network Operating System) causes improper handling of case sensitivity in device IDs, leading to misleading CORRUPT state displays for intents with uppercase letters. This creates inconsistency between intent and flow rules, potentially causing network operators to misinterpret network state. It affects ONOS deployments where operators manage network intents.
💻 Affected Systems
- ONOS (Open Network Operating System)
📦 What is this software?
Onos by Opennetworking
⚠️ Risk & Real-World Impact
Worst Case
Network operators could make incorrect decisions based on misleading CORRUPT state displays, potentially causing network misconfigurations, service disruptions, or security policy bypasses.
Likely Case
Operational confusion and potential misconfiguration of network intents due to inconsistent state reporting between the intent framework and actual flow rules.
If Mitigated
Operational inefficiency and potential minor configuration errors that can be corrected through manual verification.
🎯 Exploit Status
Exploitation requires authenticated access to ONOS and knowledge of the intent framework. The issue is triggered by normal operational actions with specific device ID formatting.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ONOS 2.6.0 or later
Vendor Advisory: https://wiki.onosproject.org/display/ONOS/Security+Advisories
Restart Required: Yes
Instructions:
1. Backup current ONOS configuration. 2. Upgrade to ONOS 2.6.0 or later. 3. Restart ONOS services. 4. Verify intent framework functionality.
🔧 Temporary Workarounds
Device ID normalization
allEnforce lowercase-only device IDs in all intent configurations
# Use lowercase device IDs in all ONOS intent configurations
# Example: deviceId:of:0000000000000001 instead of deviceId:OF:0000000000000001
Intent validation script
linuxImplement pre-deployment validation to detect uppercase letters in device IDs
#!/bin/bash
# Script to validate intent configurations
grep -i "deviceid" intent_config.json | grep -E '[A-Z]' && echo "WARNING: Uppercase detected in device ID"
🧯 If You Can't Patch
- Implement strict device ID naming conventions (lowercase only) across all network devices
- Add manual verification step for all intent deployments to cross-check intent state with actual flow rules
🔍 How to Verify
Check if Vulnerable:
Create an intent with a device ID containing uppercase letters and check if it shows CORRUPT state while flow rules are properly installed.Check Version:
onos-version | grep "ONOS"Verify Fix Applied:
After patching, test with uppercase device IDs - intents should show correct state (INSTALLED) rather than CORRUPT.📡 Detection & Monitoring
Log Indicators:
- Intent state transitions to CORRUPT for device IDs with uppercase letters
- Mismatch logs between intent framework and flow rule installations
Network Indicators:
- Inconsistent network behavior for intents with specific device ID patterns
SIEM Query:
source="onos" AND ("CORRUPT" OR "uppercase" OR "deviceId")