CVE-2022-29604

An issue was discovered in ONOS 2.5.1

Critical · published April 20, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
62.7
In the wild
Unconfirmed
What it is

🔥 An uppercase letter in a device ID can mislead your network operations! This little oversight in ONOS 2.5.1 causes intents to show up as CORRUPT, leading to confusion and potential mishaps. Think of it like a restaurant that serves only lowercase desserts — ordering 'Ice Cream' could result in your dessert getting labeled as 'CORRUPT' simply because of a menu inconsistency! It’s not just misleading; it can throw off the entire order preparation process. If your device ID is misinterpreted due to case sensitivity, it could lead to misconfiguration in the network flow rules. An operator might think everything is fine, only to discover that the network is running with faulty intents, which could cause critical functionality to fail or even result in a full network outage.

Put simply

Think of it like a restaurant that serves only lowercase desserts — ordering 'Ice Cream' could result in your dessert getting labeled as 'CORRUPT' simply because of a menu inconsistency! It’s not just misleading; it can throw off the entire order preparation process. This vulnerability arises from improper case handling, leading to inconsistencies between intents and flow rules in ONOS 2.5.1. A device ID with an uppercase letter results in a CORRUPT state, misleading operators about the actual status of network operations.

What to do

If your device ID is misinterpreted due to case sensitivity, it could lead to misconfiguration in the network flow rules. An operator might think everything is fine, only to discover that the network is running with faulty intents, which could cause critical functionality to fail or even result in a full network outage. Update ONOS to the latest version to resolve this case sensitivity issue. Review all device IDs for potential mislabeling to ensure your network operates smoothly and accurately. It's essential to keep your network documentation consistent to avoid confusion in the future. You've got this! Just a quick update and a few checks, and your network will be back to superhero status! 🦸‍♂️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01007 · 62.7th percentile
Published
2023-04-20T00:00Z
EPSS history
Timeline
  • 20 APR 00:00Z
    An issue was discovered in ONOS 2.5.1
    cvelistv5