CVE-2023-3153 Service monitor mac flow is not rate limited
An attacker can cause a denial of service in Open Virtual Network by exploiting a lack of rate limiting on service monitor MAC flows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-3153?
CVE-2023-3153 is a medium-severity denial of service vulnerability in Redhat Openshift Container Platform, published on 4 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured.
Which versions are affected by CVE-2023-3153?
It affects 3 products.
Linux distribution packages (9)
ovn22.12 Red Hat:openshift:4.11::el8 | All versions | 0:22.12.1-18.el8fdp |
ovn22.12-central Red Hat:openshift:4.11::el8 | All versions | 0:22.12.1-18.el8fdp |
ovn22.12-central-debuginfo Red Hat:openshift:4.11::el8 | All versions | 0:22.12.1-18.el8fdp |
ovn22.12-debuginfo Red Hat:openshift:4.11::el8 | All versions | 0:22.12.1-18.el8fdp |
ovn22.12-debugsource Red Hat:openshift:4.11::el8 | All versions | 0:22.12.1-18.el8fdp |
ovn22.12-host Red Hat:openshift:4.11::el8 | All versions | 0:22.12.1-18.el8fdp |
ovn22.12-host-debuginfo Red Hat:openshift:4.11::el8 | All versions | 0:22.12.1-18.el8fdp |
ovn22.12-vtep Red Hat:openshift:4.11::el8 | All versions | 0:22.12.1-18.el8fdp |
ovn22.12-vtep-debuginfo Red Hat:openshift:4.11::el8 | All versions | 0:22.12.1-18.el8fdp |
Products include Ovn Open Virtual Network, Redhat Fast Datapath, Redhat Openshift Container Platform.
How do I fix CVE-2023-3153?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-3153 being exploited?
There is no known exploitation of CVE-2023-3153 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2023-3153, GHSA-qq9r-36hc-f769, RHSA-2023:6274, UBUNTU-CVE-2023-3153.