Skip to content
Fencer Vulns
medium 5.3

CVE-2023-3153 json

Service monitor mac flow is not rate limited

published 2023-10-04 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-43837

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits
0
none known

Summary

A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured.

Patch / fix

  • ovn open_virtual_network 22.03.3, 22.09.2, 22.12.1, 23.03.1, 23.06.1
  • ovn Debian 12 23.03.1-1~deb12u1
  • ovn Debian 13 23.09.0-1

debian advisories DEBIAN-CVE-2023-3153

  • ovn Ubuntu 22.04 LTS 22.03.3-0ubuntu0.22.04.1

ubuntu advisories UBUNTU-CVE-2023-3153

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • fmt openshift 4.14 9.1.0-1.el9
  • crun openshift 4.14 1.9.2-1.rhaos4.14.el8
  • crun openshift 4.14 1.9.2-1.rhaos4.14.el9
  • perf openshift 4.14 5.14.0-284.36.1.el9_2
  • rtla openshift 4.14 5.14.0-284.36.1.el9_2
  • runc openshift 4.14 4:1.1.9-2.1.rhaos4.14.el8
  • runc openshift 4.14 4:1.1.9-2.1.rhaos4.14.el9
  • catch openshift 4.14 3.3.2-1.el9

red hat advisories RHSA-2023:5009RHSA-2023:6274

  • openvswitch3 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +3 more 3.1.7-150500.3.25.1
  • openvswitch SLES for SAP 15 SP6, SLES 15 SP6-LTSS, openSUSE Leap 15.6 3.1.7-150600.33.9.1
  • openvswitch3 SLE Module for Server Applications 15 SP5, openSUSE Leap 15.5 3.1.0-150500.3.6.2

suse advisories SUSE-SU-2026:0290-1SUSE-SU-2026:0280-1SUSE-SU-2023:3710-1

  • openvswitch openSUSE Tumbleweed 3.1.0-15.1

opensuse advisories openSUSE-SU-2024:13206-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-3153 updated cvss 5.3

ovn: service monitor MAC flow is not rate limited

  • Red Hat Fast Datapath for RHEL 7 ovn2.11, ovn2.12, ovn2.13, ovn2.11-host, ovn2.11-vtep, ovn2.12-host, +6 more
    affected: no fix planned “Will not fix”
  • Red Hat Fast Datapath for RHEL 8 ovn2.11, ovn2.12, ovn2.13, ovn-2021, ovn22.03, ovn22.06, +34 more Red Hat Fast Datapath for RHEL 9 ovn-2021, ovn22.03, ovn22.06, ovn22.09, ovn22.12, ovn23.03, +47 more Red Hat Fast Datapath for RHEL 10 ovn25.03, ovn25.09, ovn25.03-host, ovn25.03-vtep, ovn25.09-host, ovn25.09-vtep, +7 more Red Hat OpenShift Container Platform 4 ovn22.06, ovn22.09, ovn23.03, ovn23.06, ovn24.03, ovn24.09, +18 more
    affected: no fix available “Fix deferred”
  • Red Hat OpenStack Platform 13 (Queens) ovn2.11, ovn2.11-host, ovn2.11-vtep, ovn2.11-central
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4.11 ovn22.12 22.12.1-18.el8fdp, ovn22.12-host 22.12.1-18.el8fdp, ovn22.12-vtep 22.12.1-18.el8fdp, ovn22.12-central 22.12.1-18.el8fdp
    fixed: vendor fix RHSA-2023:6274
  • Red Hat OpenShift Container Platform 4.13 openshift4/ose-ovn-kubernetes v4.13.0-202310141544.p0.g6f9d5cd.assembly.stream, openshift4/ose-ovn-kubernetes-microshift-rhel9 v4.13.0-202310141544.p0.g6f9d5cd.assembly.stream
    fixed: vendor fix RHSA-2023:5672
  • Red Hat OpenShift Container Platform 4.14 ovn23.09 23.09.0-37.el9fdp, ovn23.09-host 23.09.0-37.el9fdp, ovn23.09-vtep 23.09.0-37.el9fdp, ovn23.09-central 23.09.0-37.el9fdp
    fixed: vendor fix RHSA-2023:5009
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.11 python-eventlet 0.30.2-3.el8, python3-eventlet 0.30.2-3.el8 Red Hat Ironic content for Red Hat OpenShift Container Platform 4.14 python-pbr 5.11.1-0.1.el9, python-wrapt 1.14.1-1.el9, python3-pbr 5.11.1-0.1.el9, python3-wrapt 1.14.1-1.el9, python-fixtures 4.0.1-1.el9, python-tenacity 6.3.1-1.el9, +135 more Red Hat OpenShift Container Platform 4.11 cri-tools 1.24.2-7.1.el8, perf 4.18.0-372.78.1.el8_6, kernel 4.18.0-372.78.1.el8_6, runc 1.1.2-2.1.rhaos4.11.el8, bpftool 4.18.0-372.78.1.el8_6, conmon 2.1.2-4.1.rhaos4.11.el8, +56 more Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202310141129-0, openshift4/ose-cli v4.13.0-202310130726.p0.g717d4a5.assembly.stream, openshift4/ose-pod v4.13.0-202310140746.p0.gc7606e7.assembly.stream, openshift4/ose-tests v4.13.0-202310130726.p0.g40d3885.assembly.stream, openshift4/ose-console v4.13.0-202310132202.p0.g303c2bd.assembly.stream, openshift4/ose-coredns v4.13.0-202310101544.p0.g598440f.assembly.stream, +184 more Red Hat OpenShift Container Platform 4.14 fmt 9.1.0-1.el9, catch 3.3.2-1.el9, gmock 1.13.0-1.el9, gtest 1.13.0-1.el9, cri-tools 1.27.0-2.1.el8, cri-tools 1.27.0-2.1.el9, +151 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.99% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

  • n/a ovn
  • Red Hat Fast Datapath for RHEL 7
  • Red Hat Fast Datapath for RHEL 8
  • Red Hat Fast Datapath for RHEL 9
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenStack Platform 13 (Queens)
  • Fedora Fedora

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.