Description for CVE-2023-41591

gistfile1.txt

[Description]
An issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC addresses and potentially execute a man-in-the-middle attack on communications between fake and real hosts.

------------------------------------------

[Vulnerability Type]
Insecure Permissions

------------------------------------------

[Vendor of Product]
Open Network Foundation

------------------------------------------

[Affected Product Code Base]
ONOS - 2.7.0

------------------------------------------

[Affected Component]
core/net/src/main/java/org/onosproject/net/host/impl/HostManager.java

------------------------------------------

[Attack Type]
Context-dependent

------------------------------------------

[Impact Escalation of Privileges]
true

------------------------------------------

[CVE Impact Other]
CWE-300: Channel Accessible by Non-Endpoint

------------------------------------------

[Attack Vectors]
send crafted PACKET_OUT message with the egress port to 255, which is the controller port for BMv2 switch by default

------------------------------------------

[Reference]
https://wiki.onosproject.org/pages/viewpage.action?pageId=16122675

------------------------------------------

[Discoverer]
Jiwon Kim