Link Spoofing in Floodlight SDN Controller

Executive Summary

This vulnerability is a topology boundary identification flaw in the Floodlight SDN controller that disrupts host communication. It occurs when the controller processes high-layer protocol packets, causing it to misclassify ports as non-boundaries instead of topology boundaries. This prevents packet forwarding and flow rule deployment, breaking communication between hosts.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring Floodlight controller logs for misclassified ports or unusual LLDP packet processing. Check for ports marked as non-boundaries despite connecting hosts. Use Floodlight's REST API to query topology data and verify boundary classifications. Monitor for dropped packets or failed flow rule installations between SDN and traditional switches.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this by spoofing links, sending crafted LLDP packets to manipulate the controller's topology perception. This leads to denial-of-service conditions where hosts connected to SDN switches cannot communicate with other network segments or malicious hosts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability disrupts host communication via link spoofing, which could lead to unauthorized network access or data interception. Such disruptions may violate data integrity and availability requirements in GDPR and HIPAA, potentially causing compliance breaches if sensitive data is exposed or inaccessible during an attack.

Useful 0 Not Useful 0

Mitigation Strategies

Update Floodlight to the latest patched version. Disable LLDP processing on untrusted ports or implement strict input validation for LLDP packets. Configure Floodlight to ignore spoofed LLDP packets by enabling topology verification features. Restrict access to the controller's management interface and monitor network traffic for anomalous LLDP floods.

Useful 0 Not Useful 0