What’s Vulnerable › Vulnerabilities

CVE-2023-3153: Service monitor mac flow is not rate limited

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-04 · updated 2026-06-17
• Weakness: CWE-400

Description

A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured.

Affected products

• Ovn Open Virtual Network: before 22.03.3; from 22.03.4 before 22.09.2; from 22.09.3 before 22.12.1; from 22.12.2 before 23.03.1; from 23.03.2 before 23.06.1 — fixed in 22.03.3, 22.09.2, 22.12.1, 23.03.1, 23.06.1
• RedHat Fast Datapath: all versions
• Red Hat OpenShift Container Platform 4.18: 4.0

How to fix

Upgrade to a fixed version: Ovn Open Virtual Network 22.03.3, 22.09.2, 22.12.1, 23.03.1. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/security/cve/CVE-2023-3153
• https://bugzilla.redhat.com/show_bug.cgi?id=2213279
• https://github.com/ovn-org/ovn/commit/9a3f7ed905e525ebdcb14541e775211cbb0203bd
• https://github.com/ovn-org/ovn/issues/198
• https://mail.openvswitch.org/pipermail/ovs-announce/2023-August/000327.html
• https://mail.openvswitch.org/pipermail/ovs-dev/2023-August/407553.html
• https://access.redhat.com/security/cve/CVE-2023-3153
• https://bugzilla.redhat.com/show_bug.cgi?id=2213279
• https://github.com/ovn-org/ovn/commit/9a3f7ed905e525ebdcb14541e775211cbb0203bd
• https://github.com/ovn-org/ovn/issues/198
• https://mail.openvswitch.org/pipermail/ovs-announce/2023-August/000327.html
• https://mail.openvswitch.org/pipermail/ovs-dev/2023-August/407553.html

Get alerted when CVE-2023-3153 or the next vulnerability affects your stack