Service monitor mac flow is not rate limited
Priority LOW 32CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 3 fixed, 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-400.
Summary
A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00994 62nd percentileScored 2026-11-07
Fix Partial ovn: 22.12.1, 22.03.3, 23.06.1 +2Red Hat: 3 advisoriesRed Hat: 3 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | ovn | — | 22.12.1, 22.03.3, 23.06.1, 23.03.1, 22.09.2 | Patch available | CNA |
| Red Hat | Fast Datapath for RHEL 7 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 7 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 7 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 9 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 9 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 9 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 9 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 9 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 13 (Queens) | — | — | No fix listed | CNA |
| Fedora | Fedora | — | — | No fix listed | CNA |
- ovn Vendor— Affected — Fixed in 22.12.1, 22.03.3, 23.06.1, 23.03.1, 22.09.2 Patch available CNA
- Fast Datapath for RHEL 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 13 (Queens) VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fedora VendorFedora Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ovn:open_virtual_network:*:*:*:*:*:*:*:* | before 22.03.3; 22.03.4 to before 22.09.2; 22.09.3 to before 22.12.1; 22.12.2 to before 23.03.1; 23.03.2 to before 23.06.1 | Vulnerable | Ovn |
| cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:fast_datapath:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Running on | Red Hat |
- cpe:2.3:a:ovn:open_virtual_network:*:*:*:*:*:*:*:* Versions before 22.03.3; 22.03.4 to before 22.09.2; 22.09.3 to before 22.12.1; 22.12.2 to before 23.03.1; 23.03.2 to before 23.06.1 Vulnerable ·Ovn
- cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:fast_datapath:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·Red Hat
Remediation
- Fix · CNA ovn Fixed in 22.12.1, 22.03.3, 23.06.1, 23.03.1, 22.09.2
Red Hat 3 advisories
- RHSA-2023:6274 Released 2023-11-08 · Red Hat rating ModerateOpenShift Container Platform 4.11.53 packages and security update
- Red Hat OpenShift Container Platform 4.11 ovn22.12-22.12.1-18.el8fdp, ovn22.12-central-22.12.1-18.el8fdp, ovn22.12-host-22.12.1-18.el8fdp +1
- RHSA-2023:5009 Released 2023-10-31 · Red Hat rating ImportantOpenShift Container Platform 4.14.0 security update
- Ironic content for Red Hat OpenShift Container Platform 4.14 openstack-ironic-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-api-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-common-1:21.5.0-0.20231002130534.0df5961.el9 +47
- Red Hat OpenShift Container Platform 4.14 afterburn-5.4.3-1.rhaos4.14.el9, afterburn-dracut-5.4.3-1.rhaos4.14.el9, bpftool-7.0.0-284.36.1.el9_2 +47
- RHSA-2023:5672 Released 2023-10-17 · Red Hat rating ImportantOpenShift Container Platform 4.13.17 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/ose-cluster-machine-approver, openshift4/ose-hyperkube, openshift4/ose-ovn-kubernetes +2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Fast Datapath for RHEL 10 | Affected | No fix yet: Fix deferred |
| Fast Datapath for RHEL 7 | Affected | No fix planned: Will not fix |
| Fast Datapath for RHEL 8 | Affected | No fix yet: Fix deferred |
| Fast Datapath for RHEL 9 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2023:6274 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2023:5672 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2023:5009 |
Not affected: 5 products
- Ironic content for Red Hat OpenShift Container Platform 4.11
- Ironic content for Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
Timeline
- 2026-10-02 Threatist record created from CVE-2023-3153
- 2026-10-03 Alias added: GHSA-qq9r-36hc-f769
- 2026-10-20 Affected versions changed · Red Hat
References
Patch 3
More Red Hat Fast Datapath vulnerabilities
- TI-2023-01565 A flaw was found in openvswitch (OVS). CVSS 3.1HIGH 8.2
- TI-2023-04937 Openvswitch don't match packets on nd_target field CVSS 3.1HIGH 7.1
Sources
- CVE-2023-3153 · CVE Program
- CVE-2023-3153 · NVD
- FIRST EPSS
- GHSA-qq9r-36hc-f769 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-3153 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences