CVE-2020-35214

Vulnerability

Atomix v3.1.5 contains a flaw where a malicious node can abuse primitive operations to remove states from ONOS storage. The issue is in the distributed primitive implementation, allowing unauthorized deletion of state data. [1]

Exploitation

An attacker must have control of a node within the Atomix cluster. No authentication is required beyond being a participating node. The attacker can send crafted primitive operations that delete storage states, bypassing normal safeguards. [1]

Impact

Successful exploitation results in deletion of ONOS storage states, causing data loss and potential disruption of network operations. The attacker gains the ability to corrupt or destroy critical state information. [1]

Mitigation

As of the publication date (2021-12-16), no patch has been released. Users should monitor the Atomix project for updates. The affected version is v3.1.5. [2] No workaround is documented.