SEC-7 ONOS DoS Vulnerability: CVE-2015-7516

CRSA-2015-0007.yaml

@@ -0,0 +1,27 @@
+title: 'ONOS: denial-of-service (DoS) due to exception handling while deserializing jumbo frames'
+
+description: 'It was found that the packet deserializers in ONOS would throw exceptions when handling malformed, truncated or maliciously-crafted packets. The exceptions were not caught and handled, which would result in the relevant switch being disconnected because an exception occurred in an I/O thread. A remote unauthenticated attacker could use this flaw to perform a denial-of-service (DoS) attack by causing ONOS to disconnect switches.'
+
+references:
+  - https://wiki.onosproject.org/display/ONOS/Security+advisories
+
+affected-products:
+
+  - product: ONOS
+    version:
+      - id: 1.3.0
+        component: onos
+        issues:
+          - 143
+        patches:
+          - https://gerrit.onosproject.org/#/c/6137/
+
+vulnerabilities:
+
+  - cve-id: CVE-2015-7516
+
+reporters:
+
+  - name: 'Kashyap Thimmaraju, Liron Schiff and Dr. Stefan Schmid'
+    reported:
+      - CVE-2015-7516