On the Feasibility and Enhancement of the Tuple Space Explosion Attack against Open vSwitch
This research is significant for network administrators and cloud providers using Open vSwitch, as it identifies and enhances a critical denial-of-service vulnerability that can severely impact network performance.
This paper investigates the Tuple Space Explosion (TSE) attack against Open vSwitch (OVS), a denial-of-service attack that exploits an algorithmic deficiency in packet classification. The authors demonstrate that TSE remains effective in newer OVS versions, degrading performance to ~1% of baseline with less than 1 Mbps attack rate when the kernel datapath is compiled from a different source. They also propose TSE 2.0 and TSE 2.1 to achieve complete DoS against OVS-DPDK, even when running on multiple cores, by defeating its enhanced ranking process.
Being a crucial part of networked systems, packet classification has to be highly efficient; however, software switches in cloud environments still face performance challenges. The recently proposed Tuple Space Explosion (TSE) attack exploits an algorithmic deficiency in Open vSwitch (OVS). In TSE, legitimate low-rate attack traffic makes the cardinal linear search algorithm in the Tuple Space Search (TSS) algorithm to spend an unaffordable time for classifying each packet resulting in a denial-of-service (DoS) for the rest of the users. In this paper, we investigate the feasibility of TSE from multiple perspectives. Besides showing that TSE is still efficient in the newer version of OVS, we show that when the kernel datapath is compiled from a different source, it can degrade its performance to ~1% of its baseline with less than 1 Mbps attack rate. Finally, we show that TSE is much less effective against OVS-DPDK with userspace datapath due to the enhanced ranking process in its TSS implementation. Therefore, we propose TSE 2.0 to defeat the ranking process and achieve a complete DoS against OVS-DPDK. Furthermore, we present TSE 2.1, which achieves the same goal against OVS-DPDK running on multiple cores without significantly increasing the attack rate.