CVE-2021-38364 in ONOS
Summary
by MITRE • 04/20/2023
An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently modify or delete the existing flow rules related to other intents.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/14/2023
The vulnerability identified as CVE-2021-38364 resides within the ONOS (Open Network Operating System) platform version 2.5.1, representing a critical flaw in the intent-based networking architecture that governs software-defined networking environments. This issue manifests through an improper comparison mechanism that governs how flow rules are managed when intents are installed or modified within the network control plane. The vulnerability stems from inadequate validation processes that fail to properly distinguish between different intents, creating a scenario where operations intended for one network policy can inadvertently affect other established network rules.
The technical implementation of this vulnerability exploits a fundamental flaw in the intent processing subsystem where the system fails to maintain proper isolation between concurrent intent operations. When a remote attacker successfully installs or removes a new intent, the flawed comparison logic allows the system to incorrectly associate or mismanage flow rules that were originally configured for different intents. This mismanagement occurs because the intent comparison mechanism lacks proper contextual awareness and fails to maintain separate namespaces for different intent configurations, resulting in cross-contamination of network flow rules.
The operational impact of this vulnerability extends beyond simple network disruption to encompass potential security compromise and service degradation within SDN environments. Attackers can leverage this flaw to perform unauthorized modifications to existing network policies, potentially redirecting traffic flows, blocking legitimate network operations, or creating backdoor access paths within the controlled network infrastructure. The vulnerability particularly affects environments where multiple network policies are simultaneously active, as the incorrect comparison logic amplifies the scope of potential impact across interconnected network segments.
This vulnerability aligns with CWE-284 (Improper Access Control) and CWE-347 (Improper Verification of Cryptographic Signature) categories, reflecting the core issue of inadequate access control validation within the intent processing framework. From an ATT&CK perspective, this weakness maps to T1078 (Valid Accounts) and T1566 (Phishing) as attackers could potentially use compromised accounts to install malicious intents or exploit the vulnerability to establish persistent network access. The attack surface is particularly concerning in enterprise networks where ONOS serves as the primary controller for large-scale network infrastructure management.
Mitigation strategies should focus on implementing immediate patches from the ONOS vendor that address the intent comparison logic and introduce proper isolation mechanisms between different network intents. Organizations should also deploy network monitoring solutions that can detect anomalous intent installation patterns and flow rule modifications that deviate from normal operational baselines. Additional protective measures include implementing strict access controls for intent management interfaces, enabling multi-factor authentication for administrative accounts, and establishing network segmentation policies that limit the scope of potential impact from compromised intent operations. Regular security assessments should verify that intent processing mechanisms maintain proper isolation between different network policy configurations to prevent similar vulnerabilities from emerging in future deployments.