CVE-2022-29606
📋 TL;DR
A vulnerability in ONOS 2.5.1 allows network operators to create intents with large port numbers that cause system inconsistencies. When exploited, this leads to misleading CORRUPT state displays and mismatches between intent and flow rules, potentially disrupting network operations. This affects organizations using ONOS for software-defined networking.
💻 Affected Systems
- ONOS (Open Network Operating System)
📦 What is this software?
Onos by Opennetworking
⚠️ Risk & Real-World Impact
Worst Case
Network-wide disruption with inconsistent flow rules causing traffic blackholing, routing loops, or complete network segmentation failures.
Likely Case
Network operators misled by incorrect CORRUPT state displays, leading to troubleshooting delays and potential misconfiguration of network policies.
If Mitigated
Minor operational confusion with no actual network impact if proper validation controls are implemented.
🎯 Exploit Status
Exploitation requires network operator privileges to create intents with large port numbers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ONOS versions after 2.5.1 (check latest stable release)
Vendor Advisory: https://wiki.onosproject.org/display/ONOS/Security+Advisories
Restart Required: Yes
Instructions:
1. Backup current ONOS configuration. 2. Upgrade to latest ONOS version. 3. Restart ONOS controller. 4. Verify intent framework functionality.
🔧 Temporary Workarounds
Input Validation for Intent Creation
allImplement custom validation to reject intents with port numbers outside valid range (1-65535).
# Add validation in intent creation scripts/APIs
# Example: if port > 65535: reject intent
Operator Training and Policies
allTrain network operators to avoid creating intents with invalid port numbers and implement approval workflows.
🧯 If You Can't Patch
- Implement strict input validation at API/CLI level for all intent creation operations
- Monitor intent CORRUPT states and alert on unusual patterns or large port number usage
🔍 How to Verify
Check if Vulnerable:
Check ONOS version: if running 2.5.1, test by creating an intent with port number > 65535 and observing CORRUPT state behavior.Check Version:
onos-version or check ONOS web UI dashboard for version informationVerify Fix Applied:
After upgrade, attempt to create intent with invalid port number - should be rejected with proper error message.📡 Detection & Monitoring
Log Indicators:
- Intent state transitions to CORRUPT
- Error logs mentioning port validation failures
- Intent creation attempts with large port numbers
Network Indicators:
- Mismatch between configured intents and actual flow rules
- Unexpected network traffic patterns
SIEM Query:
source="onos" AND ("CORRUPT" OR "port" AND "invalid")