CVE-2023-3153: Service monitor mac flow is not rate limited
A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured.
Other sources
The service monitor MAC is exposed through the following flow: ovnlflowadd(lflows, od, SSWITCHINL2LKUP, 110, "eth.dst == $svcmonitormac", "handlesvccheck(inport);");
This doesn't handle rate limit via CoPP. There is potential to DoS ovn-controller even on deployments with CoPP enabled and configured as all packets with this destination mac within the switch are sent directly to pinctrl thread in ovn-controller.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/ovnto a version that resolves this vulnerability.Fixed in 22.03.3 - Upgrade
Upgrade
redhat/ovnto a version that resolves this vulnerability.Fixed in 22.09.2 - Upgrade
Upgrade
redhat/ovnto a version that resolves this vulnerability.Fixed in 22.12.1 - Upgrade
Upgrade
redhat/ovnto a version that resolves this vulnerability.Fixed in 23.03.1 - Upgrade
Upgrade
redhat/ovnto a version that resolves this vulnerability.Fixed in 23.06.1
Event History
Frequently Asked Questions
What is CVE-2023-3153?
CVE-2023-3153 is a vulnerability found in Open Virtual Network that allows an attacker to cause a denial of service.
How severe is CVE-2023-3153?
CVE-2023-3153 has a severity rating of medium (5.3).
Which software versions are affected by CVE-2023-3153?
The affected software versions are OVN Open Virtual Network 22.03.3 to 23.06.1.
How can I fix CVE-2023-3153?
To fix CVE-2023-3153, update the affected software to version 22.09.2, 22.12.1, 23.03.1, or 23.06.1.
Where can I find more information about CVE-2023-3153?
More information about CVE-2023-3153 can be found at the following references: [Reference 1](https://access.redhat.com/security/cve/CVE-2023-3153), [Reference 2](https://bugzilla.redhat.com/show_bug.cgi?id=2213279), [Reference 3](https://github.com/ovn-org/ovn/commit/9a3f7ed905e525ebdcb14541e775211cbb0203bd).