CVE-2025-29312

Executive Summary

CVE-2025-29312 is a security advisory affecting ONOS (Open Network Operating System) version 2.7.0. The vulnerability allows an attacker to trigger unexpected behavior within a device connected to a legacy switch by changing the link type from indirect to direct. This manipulation can lead to network topology confusion, potential denial of service, or misrouting of traffic. The vulnerability has a CVSS score of 0.0 (unscored) and no known patch or public exploit at this time. The EPSS score is 0.0%, indicating low exploitation probability in the wild. This report provides a comprehensive technical analysis, detection engineering rules, and mitigation strategies.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality (C): None (likely)
• Integrity (I): Low (likely)
• Availability (A): Low (likely)
• Threat Level: Medium (due to potential for network disruption)

Deep Dive & Mechanics

The vulnerability resides in ONOS's link discovery and topology management subsystem. ONOS uses LLDP (Link Layer Discovery Protocol) and BDDP (Broadcast Domain Discovery Protocol) to discover network links and build a topology graph. Legacy switches may not support these protocols natively, requiring ONOS to infer link types (direct vs. indirect) based on packet forwarding behavior.

An attacker can exploit this by sending crafted packets that cause ONOS to misinterpret a link as direct when it is actually indirect. This can lead to:

• Topology Poisoning: The controller believes there is a direct link between two devices, causing incorrect path calculations.
• Traffic Blackholing: Packets may be forwarded to a non-existent direct link, resulting in packet loss.
• Denial of Service: The controller may enter a loop recalculating paths, consuming CPU resources.
• Bypass of Security Controls: Traffic may be rerouted through unintended paths, bypassing firewalls or monitoring tools.

The attack requires network access to the ONOS-controlled network and the ability to send packets that mimic LLDP/BDDP behavior.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, the vulnerable code likely resides in the link discovery module (e.g., LinkDiscoveryManager.java or similar). The fix would involve validating link type changes against known topology constraints and implementing rate limiting or cryptographic verification of link discovery packets.

Exploitation & Lab Setup

Red Team

Lab Setup:

• ONOS 2.7.0 controller running on Ubuntu 20.04
• Mininet network emulator with legacy switches (e.g., Open vSwitch with LLDP disabled)
• Attacker machine with Python and Scapy

Exploitation Steps:

1. Identify the ONOS controller IP and port (default 6653 for OpenFlow).
2. Use Scapy to craft LLDP packets that mimic a direct link between two devices that are actually connected via an indirect path.
3. Send the crafted packets to the legacy switch's data plane.
4. Monitor ONOS's topology view to confirm the link type change.
5. Observe traffic misrouting or controller instability.

Example Scapy Script:

from scapy.all import *
import sys

# Craft LLDP packet with direct link indication
lldp_pkt = Ether(dst="01:80:c2:00:00:0e", src="00:00:00:00:00:01") / \
           LLC(dsap=0xaa, ssap=0xaa, ctrl=0x03) / \
           SNAP(OUI=0x000000, code=0x88cc) / \
           LLDPDU(chassis_id="00:00:00:00:00:01", port_id="1", ttl=120)

# Send to legacy switch
sendp(lldp_pkt, iface="eth0")

Blue Team

Detection:

• Monitor for unexpected LLDP/BDDP packets from unknown sources.
• Use network anomaly detection to flag sudden topology changes.
• Implement strict LLDP filtering on legacy switches.

Mitigation:

• Disable automatic link discovery on untrusted interfaces.
• Use authentication for LLDP packets (802.1X).
• Implement rate limiting for topology change events.

Indicators of Compromise (IOCs)

• Network: Unusual LLDP/BDDP packets with mismatched source MAC addresses.
• Logs: ONOS logs showing rapid link type changes (e.g., "Link type changed from INDIRECT to DIRECT").
• Topology: Sudden appearance of direct links between devices that are geographically or logically separated.
• Traffic: Increased packet loss or routing loops in the network.

Detection Engineering

YARA Rule

rule CVE_2025_29312_LLDP_Anomaly {
    meta:
        description = "Detects crafted LLDP packets used in CVE-2025-29312 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-29312"
    strings:
        $lldp_header = { 01 80 c2 00 00 0e }
        $direct_flag = { 02 01 00 01 }  // Example direct link TLV
    condition:
        $lldp_header at 0 and $direct_flag
}

Sigma Rule

title: CVE-2025-29312 - ONOS Link Type Manipulation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects sudden link type changes in ONOS controller logs
author: Valters IT
date: 2025-04-10
logsource:
    product: onos
    service: controller
detection:
    selection:
        message: "Link type changed from INDIRECT to DIRECT"
    condition: selection
falsepositives:
    - Legitimate network reconfiguration
level: high

Suricata Rule

alert udp any any -> any 3784 (msg:"CVE-2025-29312 - ONOS LLDP Direct Link Spoofing"; content:"|01 80 c2 00 00 0e|"; depth:6; content:"|02 01 00 01|"; distance:20; within:4; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Isolate legacy switches from the ONOS controller until a patch is available.
   • Disable automatic link discovery on interfaces connected to legacy switches.
   • Implement strict ACLs to filter LLDP/BDDP packets from untrusted sources.

2. Long-term Fix:

   • Monitor ONOS GitHub for patches (https://github.com/opennetworkinglab/onos).
   • Upgrade to a patched version once released.
   • Replace legacy switches with OpenFlow-compatible hardware.

3. Compensating Controls:

   • Use network segmentation to limit exposure.
   • Deploy intrusion detection systems (IDS) with the provided Suricata rules.
   • Enable logging and alerting for topology changes.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert