CVE-2024-57672
📋 TL;DR
A local denial-of-service vulnerability in Floodlight v1.2 allows attackers with local access to crash the controller via the Topology Manager, TopologyInstance, and Routing modules. This affects organizations running vulnerable Floodlight SDN controllers. The vulnerability requires local access to the controller system.
💻 Affected Systems
- Floodlight SDN Controller
📦 What is this software?
Floodlight by Projectfloodlight
⚠️ Risk & Real-World Impact
Worst Case
Complete controller crash leading to network control plane failure, disrupting all SDN-managed network operations until manual restart.
Likely Case
Controller instability requiring restart, causing temporary network management disruption.
If Mitigated
Minimal impact if proper network segmentation and access controls prevent local attacker access.
🎯 Exploit Status
Local access required. No public exploit code identified in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check GitHub issue for latest fix
Vendor Advisory: https://github.com/floodlight/floodlight/issues/871
Restart Required: Yes
Instructions:
1. Check GitHub issue #871 for fix details. 2. Update to patched version. 3. Restart Floodlight controller.
🔧 Temporary Workarounds
Restrict Local Access
allLimit local user access to Floodlight controller host to authorized administrators only.
Implement strict user access controls
Use sudo restrictions
Apply principle of least privilege
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized local access to controller host
- Monitor controller logs for crash/restart events and implement automated alerting
🔍 How to Verify
Check if Vulnerable:
Check Floodlight version: grep version floodlight.properties or check startup logsCheck Version:
grep 'floodlight.version' floodlight.propertiesVerify Fix Applied:
Verify version is updated beyond v1.2 and monitor for stability📡 Detection & Monitoring
Log Indicators:
- Controller crash logs
- Unexpected restarts
- Topology/Routing module failure messages
Network Indicators:
- Loss of SDN controller connectivity
- Network control plane disruptions
SIEM Query:
source="floodlight.log" AND ("crash" OR "restart" OR "topology" OR "routing")