CVE-2024-51407

Vulnerability

Floodlight SDN OpenFlow Controller v1.2 has a vulnerability in its topology discovery mechanism where the controller trusts LLDP (Link Layer Discovery Protocol) messages without sufficient validation. A local host can inject forged LLDP packets that spoof the chassis ID and port information, causing the controller to construct false broadcast ports. This affects all Floodlight deployments using the default LLDP-based discovery, as described in [1] and [2].

Exploitation

An attacker must have network access to a switch that forwards LLDP packets to the Floodlight controller. The attacker runs a Python script (e.g., poc.py from [2]) that sends crafted LLDP packets with arbitrary chassis IDs and port numbers using Scapy. The script iterates over port ranges and continuously transmits these packets, causing the controller to update its topology with the spoofed information.

Impact

Successful exploitation creates false broadcast ports that split the network cluster (archipelago). Hosts connected to switches that accept the spoofed ports become unable to communicate with hosts on other switches, resulting in inter-host communication anomalies. The impact is a denial of service on network connectivity; no data is exfiltrated or corrupted, but legitimate traffic is disrupted.

Mitigation

As of the publication date (2024-11-01), no official patch has been released by the Floodlight project [1]. Operators should restrict physical or logical access to the network to prevent untrusted hosts from sending LLDP packets. Alternatively, deploy network-level filtering to validate LLDP messages or disable LLDP-based topology discovery if not required. The issue is tracked in [2], and users should monitor for updates.