OpenDaylight — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

Two O(n²) defects in OpenDaylight's flow rule management and shard management. One fires on every switch connect/reconnect during group reconciliation; the other fires per snapshot operation in the ShardManager. Patches ready for upstream review.

The Defects

odl-0001 (PATCHED — HIGH): frm/impl/DevicesGroupRegistry.java:21

// Inside group reconciliation loop — fires every switch connect/reconnect:
private List<Uint32> registeredGroups = new ArrayList<>();
// ...
if (!registeredGroups.contains(groupId)) {  // O(n) ArrayList.contains() per group
    registeredGroups.add(groupId);
}

ArrayList.contains() O(n) scan per group in the reconciliation loop. Fires on every switch connect and reconnect event. O(n²) total for n groups per switch.

odl-0002 (PATCHED — HIGH): frm/impl/ — ShardManager snapshotShardList

// O(n) linear scan per snapshot operation:
for (String shardName : snapshotShardList) {
    if (shardName.equals(target)) { ... }  // O(n) scan per snapshot
}

O(n) linear scan over snapshotShardList per snapshot operation in ShardManager.

Complexity Proof

odl-0001: For n groups per switch:

Per reconnect: O(n²) reconciliation
Fixed: LinkedHashSet<Uint32> → O(n)

odl-0002: For n shards:

Per snapshot: O(n) scan
Fixed: HashSet<String> → O(1) per lookup

Impact

All OpenDaylight deployments with flow rule management (odl-0001) and distributed datastore with shard management (odl-0002). OpenDaylight is the leading open-source SDN controller platform used in network virtualization and telecom applications. odl-0001 fires on every switch connect/reconnect — frequent in production networks during topology changes. odl-0002 fires during datastore snapshotting in clustered deployments.

The Fix

odl-0001: Replace registeredGroups ArrayList with LinkedHashSet:

// Before
private List<Uint32> registeredGroups = new ArrayList<>();
if (!registeredGroups.contains(groupId)) { registeredGroups.add(groupId); }

// After
// CWE-407 fix: LinkedHashSet for O(1) contains() instead of O(n) ArrayList scan.
private Set<Uint32> registeredGroups = new LinkedHashSet<>();
registeredGroups.add(groupId);  // Set.add() is idempotent

odl-0002: Replace snapshotShardList with HashSet<String>.

Patch

defects/odl/patch/odl-0001-0002-group-shard-hashset.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or JIRA reference.
Validate the patch against your flow rule reconciliation and shard management test suite.
Assess CVE eligibility — odl-0001 fires on every switch connect/reconnect event.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.9 KiB Raw Blame History