CVE-2023-3153 : A flaw was found in Open Virtual Network where the service monitor MAC does not

A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured.

Published 2023-10-04 12:15:11

Updated 2023-10-06 16:23:42

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2023-3153

Redhat » Openshift Container Platform » Version: 4.0
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
Matching versions
Redhat » Fast Datapath » Version: N/A
cpe:2.3:a:redhat:fast_datapath:-:*:*:*:*:*:*:*
Matching versions
When used together with: Redhat » Enterprise Linux » Version: 9.0
OVN » Open Virtual Network
Versions from including (>=) 22.12.2 and before (<) 23.03.1
cpe:2.3:a:ovn:open_virtual_network:*:*:*:*:*:*:*:*
Matching versions
OVN » Open Virtual Network
Versions from including (>=) 22.09.3 and before (<) 22.12.1
cpe:2.3:a:ovn:open_virtual_network:*:*:*:*:*:*:*:*
Matching versions
OVN » Open Virtual Network
Versions before (<) 22.03.3
cpe:2.3:a:ovn:open_virtual_network:*:*:*:*:*:*:*:*
Matching versions
OVN » Open Virtual Network
Versions from including (>=) 22.03.4 and before (<) 22.09.2
cpe:2.3:a:ovn:open_virtual_network:*:*:*:*:*:*:*:*
Matching versions
OVN » Open Virtual Network
Versions from including (>=) 23.03.2 and before (<) 23.06.1
cpe:2.3:a:ovn:open_virtual_network:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-3153

EPSS FAQ

0.13%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 49 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-3153

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	3.9	1.4	Red Hat, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low

CWE ids for CVE-2023-3153

CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-3153

https://mail.openvswitch.org/pipermail/ovs-announce/2023-August/000327.html

[ovs-announce] [ADVISORY] CVE-2023-3153 OVN: Service monitor MAC flow is not rate limited
Mitigation;Patch
https://github.com/ovn-org/ovn/issues/198

CVE-2023-3153 ovn: service monitor MAC flow is not rate limited · Issue #198 · ovn-org/ovn · GitHub
Issue Tracking
https://mail.openvswitch.org/pipermail/ovs-dev/2023-August/407553.html

[ovs-dev] [PATCH ovn] northd, controller: Add CoPP for SVC monitor
Patch
https://github.com/ovn-org/ovn/commit/9a3f7ed905e525ebdcb14541e775211cbb0203bd

northd, controller: Add CoPP for SVC monitor · ovn-org/ovn@9a3f7ed · GitHub
Patch
https://access.redhat.com/security/cve/CVE-2023-3153

CVE-2023-3153- Red Hat Customer Portal
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2213279

2213279 – (CVE-2023-3153) CVE-2023-3153 ovn: service monitor MAC flow is not rate limited
Issue Tracking

Jump to

Vulnerability Details : CVE-2023-3153

Products affected by CVE-2023-3153

Exploit prediction scoring system (EPSS) score for CVE-2023-3153

CVSS scores for CVE-2023-3153

CWE ids for CVE-2023-3153

References for CVE-2023-3153