CVE-2021-38363

HIGH

ONOS 2.5.1 - Denial of Service via IntentManager Exception Handling

Title source: llm
STIX 2.1

Description

An issue was discovered in ONOS 2.5.1. In IntentManager, the install-requested intent (which causes an exception) remains in pendingMap (in memory) forever. Deletion is possible neither by a user nor by the intermittent Intent Cleanup process.

References (2)

Core 2
Core References
Exploit, Technical Description, Third Party Advisory
https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf

Scores

CVSS v3 7.5
EPSS 0.0065
EPSS Percentile 46.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-755
Status published
Products (1)
opennetworking/onos 2.5.1
Published Apr 20, 2023
Tracked Since Feb 18, 2026