CVE-2024-31164 – A NULL pointer dereference vulnerability in ONF... (How to Fix)

Q: What is the severity of CVE-2024-31164?

CVE-2024-31164 has a CVSS score of 5.3 (MEDIUM). A NULL pointer dereference vulnerability in ONF libfluid's fluid_msg::ActionList::unpack13 function allows attackers to cause denial of service by crashing applications using this library. This affects systems running libfluid 0.1.0, particularly those implementing OpenFlow protocol handling.

📋 TL;DR

A NULL pointer dereference vulnerability in ONF libfluid's fluid_msg::ActionList::unpack13 function allows attackers to cause denial of service by crashing applications using this library. This affects systems running libfluid 0.1.0, particularly those implementing OpenFlow protocol handling.

💻 Affected Systems

Products:

Open Networking Foundation libfluid

Versions: 0.1.0

Operating Systems: Linux, Unix-like systems

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using libfluid_msg module with fluid_msg::ActionList::unpack13 function calls.

📦 What is this software?

Libfluid Msg by Opennetworking

View all CVEs affecting Libfluid Msg →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete application crash leading to denial of service for network control functions, potentially disrupting network operations.

🟠

Likely Case

Application instability or crashes when processing malformed OpenFlow messages, causing temporary service disruption.

🟢

If Mitigated

Minimal impact with proper input validation and error handling in place.

🌐 Internet-Facing: MEDIUM - If the vulnerable component processes external OpenFlow messages, it could be exploited remotely.

🏢 Internal Only: MEDIUM - Internal network management systems using libfluid could be affected by crafted messages.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires sending specially crafted OpenFlow messages to trigger the vulnerable code path.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Not available

Vendor Advisory: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31164

Restart Required: Yes

Instructions:

1. Monitor ONF for official patch release. 2. Apply patch when available. 3. Restart affected services. 4. Verify fix implementation.

🔧 Temporary Workarounds

Input Validation Enhancement

all

Add additional input validation checks before calling fluid_msg::ActionList::unpack13 function

# Requires code modification - no direct command

Error Handling Wrapper

all

Implement wrapper function with proper NULL pointer checks around unpack13 calls

# Requires code modification - no direct command

🧯 If You Can't Patch

Isolate systems using libfluid from untrusted networks
Implement network filtering to block malformed OpenFlow messages

🔍 How to Verify

Check if Vulnerable:

Check if libfluid 0.1.0 is installed and if applications use fluid_msg::ActionList::unpack13 function

Check Version:

ldconfig -p | grep libfluid || find /usr -name '*libfluid*' -type f

Verify Fix Applied:

Verify libfluid version is updated beyond 0.1.0 when patch becomes available

📡 Detection & Monitoring

Log Indicators:

Segmentation fault errors
Application crashes with NULL pointer references
Unexpected termination of network control processes

Network Indicators:

Malformed OpenFlow packets
Unusual OpenFlow message patterns

SIEM Query:

source="application_logs" AND ("segmentation fault" OR "null pointer" OR "SIGSEGV") AND process="*libfluid*"

📊 Metadata

CVE ID: CVE-2024-31164

CVSS v3 Score: 5.3 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE: CWE-690

Published: September 18, 2024

Last Updated: September 20, 2024

🔗 References

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31164 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-31164, you might also want to check these: